[gentoo-user] something is filling up the filesystem

[gentoo-user] something is filling up the filesystem

[Pupino]

Hi all,
i noticed a strange behaviour on my macine recently.
Something is continuously filling up my root partition at a speed near
1k per minute.
I have just few programs running and none of them should save that
much information on the disk.
Now the problem is that i have absolutely no idea of where to start to
investigate.
Anyone have ever got a similar problem?
Thanks to all,
Davide

Re: [gentoo-user] something is filling up the filesystem

[Albert Hopkins]

On Sun, 2008-11-30 at 01:15 +0000, Pupino wrote:
> Hi all,
> i noticed a strange behaviour on my macine recently.
> Something is continuously filling up my root partition at a speed near
> 1k per minute.
> I have just few programs running and none of them should save that
> much information on the disk.
> Now the problem is that i have absolutely no idea of where to start to
> investigate.

du?

> Anyone have ever got a similar problem?

Not here.

> Thanks to all,
> Davide
> 

RE: [gentoo-user] something is filling up the filesystem

[Dio, James]

> Hi all,
> i noticed a strange behaviour on my macine recently.
> Something is continuously filling up my root partition at a speed near
> 1k per minute.
> I have just few programs running and none of them should save that
> much information on the disk.
> Now the problem is that i have absolutely no idea of where to start to
> investigate.

I would consider checking if something is logging a lot, I have had some
programs far too verbose with its logs filling up /var/log 

du -h /var/log

> Anyone have ever got a similar problem?
> Thanks to all,
> Davide

Re: [gentoo-user] something is filling up the filesystem

[Daniel Pielmeier]

[-- Attachment #1: Type: text/plain, Size: 676 bytes --]

Pupino schrieb am 30.11.2008 02:15:
> Hi all,
> i noticed a strange behaviour on my macine recently.
> Something is continuously filling up my root partition at a speed near
> 1k per minute.
> I have just few programs running and none of them should save that
> much information on the disk.
> Now the problem is that i have absolutely no idea of where to start to
> investigate.
> Anyone have ever got a similar problem?
> Thanks to all,
> Davide
> 

First I would try to search for files that have changed recently and
than try to find out which program writes to them.

find / -mmin -10

Lists files whose content has changed in the last ten minutes.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

Re: [gentoo-user] something is filling up the filesystem

[Volker Armin Hemmann]

On Sunday 30 November 2008, Pupino wrote:
> Hi all,
> i noticed a strange behaviour on my macine recently.
> Something is continuously filling up my root partition at a speed near
> 1k per minute.
> I have just few programs running and none of them should save that
> much information on the disk.
> Now the problem is that i have absolutely no idea of where to start to
> investigate.
> Anyone have ever got a similar problem?
> Thanks to all,
> Davide

are /var, or /tmp part of / or on their own partitions? do you use X as root?

Re: [gentoo-user] something is filling up the filesystem

[Michele Schiavo]

[-- Attachment #1.1: Type: text/plain, Size: 503 bytes --]

lsof ?

Il giorno dom, 30/11/2008 alle 01.15 +0000, Pupino ha scritto:

> Hi all,
> i noticed a strange behaviour on my macine recently.
> Something is continuously filling up my root partition at a speed near
> 1k per minute.
> I have just few programs running and none of them should save that
> much information on the disk.
> Now the problem is that i have absolutely no idea of where to start to
> investigate.
> Anyone have ever got a similar problem?
> Thanks to all,
> Davide
> 

[-- Attachment #1.2: Type: text/html, Size: 777 bytes --]

[-- Attachment #2: Questa è una parte del messaggio firmata digitalmente --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: [gentoo-user] something is filling up the filesystem

[Pupino]

2008/11/30 Dio, James <jdio@rwmc.org>:
>> Hi all,
>> i noticed a strange behaviour on my macine recently.
>> Something is continuously filling up my root partition at a speed near
>> 1k per minute.
>> I have just few programs running and none of them should save that
>> much information on the disk.
>> Now the problem is that i have absolutely no idea of where to start to
>> investigate.
>
> I would consider checking if something is logging a lot, I have had some
> programs far too verbose with its logs filling up /var/log
>
> du -h /var/log
>
>> Anyone have ever got a similar problem?
>> Thanks to all,
>> Davide
>
>

this was the right direction.
i found a 13Gb /var/log/messages , really too big!
The cause seems to be network related, probably fault of
networkmanager or wicd as the file is full of:

Nov 30 03:31:52 spaventapasseri TKIP decrypt: iv16=47b7 iv32=00000005
Nov 30 03:31:52 spaventapasseri TKIP decrypt: Phase2 rc4key=47 67 b7
06 7b 87 14 96 0a ad 0a 14 af 0f 42 d5
Nov 30 03:31:53 spaventapasseri TKIP decrypt: data(len=56) 47 67 b8 60
05 00 00 00 a0 00 b5 3e f2 54 a3 34 11 d6 e4 db 1e 39 e5 c7 ad e3 16
fb 57 c9 3d d9 ca 8e da 49 db 8b b7 a0 e0 73 88 bc 6b e9 f2 d9 10 0f
26 01 b9 ab 3f 9c
Nov 30 03:31:53 spaventapasseri TKIP decrypt: iv16=47b8 iv32=00000005
Nov 30 03:31:53 spaventapasseri TKIP decrypt: Phase2 rc4key=47 67 b8
b5 2a 86 55 18 4d d4 c1 68 9c 7a 25 28
Nov 30 03:31:53 spaventapasseri TKIP decrypt: data(len=56) 47 67 b9 60
05 00 00 00 b1 43 0b 44 12 f8 a3 1a 4f e7 fe a2 8a 5b d9 05 32 80 ee
71 70 cc 88 63 06 70 9b b3 85 81 e2 09 36 4d 06 85 b7 24 30 a1 86 78
5a 3f 3a 31 c0 b7
Nov 30 03:31:53 spaventapasseri TKIP decrypt: iv16=47b9 iv32=00000005
Nov 30 03:31:53 spaventapasseri TKIP decrypt: Phase2 rc4key=47 67 b9
fb 58 3c 31 d3 83 9c 0a 69 a8 d8 b9 7e
Nov 30 03:31:53 spaventapasseri TKIP decrypt: data(len=56) 47 67 ba 60
05 00 00 00 00 88 96 27 61 0d ce 48 c9 32 94 45 6a 1f d9 8c ba 57 64
37 2f 12 1e 3f 34 36 c9 f9 d2 ae a7 0b a5 a8 01 8d 4e 1a ef 2d 43 21
10 6f 04 f1 f1 6e
Nov 30 03:31:53 spaventapasseri TKIP decrypt: iv16=47ba iv32=00000005
Nov 30 03:31:53 spaventapasseri TKIP decrypt: Phase2 rc4key=47 67 ba
71 d8 2c 38 80 14 ae ae bc 21 10 ad 7b

So tomorrow i'll try to find out wich one is guilty and try find a
remedy... (now it's 3 am, i'm a bit tired...)
i'll post back.

Thank you all for the quick help!
Davide

Re: [gentoo-user] something is filling up the filesystem

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 424 bytes --]

On Sun, 30 Nov 2008 02:35:19 +0100, Daniel Pielmeier wrote:

> First I would try to search for files that have changed recently and
> than try to find out which program writes to them.
> 
> find / -mmin -10

Add -xdev to that, otherwise it will search everything,
including /proc, /sys and /home,producing a lot of false results.


-- 
Neil Bothwick

Master of all I survey (at the moment, empty pizza boxes)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: [gentoo-user] something is filling up the filesystem

[Pupino]

> So tomorrow i'll try to find out wich one is guilty and try find a
> remedy... (now it's 3 am, i'm a bit tired...)
> i'll post back.
>
> Thank you all for the quick help!
> Davide
>

I found that i had accidentally enable the full debugging output of my
wireless card in the kernel, so that was where all those messages came
from.

Thanks again to every one.
Davide

Re: [gentoo-user] something is filling up the filesystem

[Mick]

[-- Attachment #1: Type: text/plain, Size: 296 bytes --]

On Sunday 30 November 2008, Michele Schiavo wrote:
> lsof ?

Both find and lsof are good to show what is/has been accessed/changed.  
However, you may want to think of setting up logrotate and giving it a max 
size for your log file(s) above which it will rotate them.
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: [gentoo-user] something is filling up the filesystem

[Dale]

Mick wrote:
> On Sunday 30 November 2008, Michele Schiavo wrote:
>   
>> lsof ?
>>     
>
> Both find and lsof are good to show what is/has been accessed/changed.  
> However, you may want to think of setting up logrotate and giving it a max 
> size for your log file(s) above which it will rotate them.
>   

I'm not sure how fast logrotate checks the size but it sounded like his
was getting big pretty fast.  It may not would have checked often enough
to do him any good.  It is a good idea tho.  I do my emerge log and
messages by size as well.  I know when hal or something thinks I have a
disc in the DVD drive but don't, it can put a LOT in messages. 

Good idea tho. 

Dale

:-)  :-)