linuxdebiansystem-administration

debian df -h vs du -hs, unable to find taken space


I have a partition which is almost filled up (/)

 df -h
Filesystem      Size  Used Avail Use% Mounted on
udev             10M     0   10M   0% /dev
tmpfs           6.3G  675M  5.6G  11% /run
/dev/md2         20G   18G  534M  98% /
tmpfs            16G     0   16G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs            16G     0   16G   0% /sys/fs/cgroup
/dev/nvme0n1p1  510M  152K  510M   1% /boot/efi
/dev/md3        450G   44G  383G  11% /home
tmpfs           3.2G     0  3.2G   0% /run/user/0
tmpfs           3.2G     0  3.2G   0% /run/user/1001

I'm not able to find by what file / folder this space is taken

du -hs
35M boot
0   dev
4.8M    etc
44G home
46M lib
4.0K    lib64
8.0K    media
4.0K    mnt
216K    opt
101M    root
675M    run
23M sbin
8.0K    srv
0   sys
17M tmp
1.1G    usr
426M    var

sudo du -a / 2>/dev/null | sort -n -r | head -n 20 don't show me any "big" file on /

du -sm .[!.]* *
9   bin
35  boot
0   dev
5   etc
44590   home
46  lib
1   lib64
1   media
1   mnt
1   opt
0   proc
101 root
675 run
23  sbin
1   srv
0   sys
17  tmp
1091    usr
430 var

How can i find what is eating my disk space on / ?


Solution

  • In case it can help someone

    It seems i had some removed log files which was still opened by some process

    $ sudo find /proc/*/fd -ls | grep '(deleted)' | sort -rh | head -n 20
    1269601869    0 lrwx------   1 www-data www-data       64 Sep  7 15:32 /proc/6775/fd/19 -> /var/lib/nginx/body/0000000003\ (deleted)
    8130039    0 l-wx------   1 root     root           64 Jul 12  2022 /proc/4739/fd/2 -> /etc/openvpn/openvpn.log\ (deleted)
    8130038    0 l-wx------   1 root     root           64 Jul 12  2022 /proc/4739/fd/1 -> /etc/openvpn/openvpn.log\ (deleted)
    

    By simply restarting the services (nginx & openvpn) it has free me up 17 GO