[OpenIndiana-discuss] /hipster: question about /proc

[Predrag Zečević - Technical Support Analyst]

On 09/29/17 18:05, Richard L. Hamilton wrote:
> 
>> On Sep 29, 2017, at 11:41, Alan Coopersmith <alan.coopersmith at oracle.com> wrote:
>>
>> On 09/29/17 06:55 AM, Predrag Zečević - Technical Support Analyst wrote:
>>> Hi all,
>>> I got today alert (actually blinking TimeSlider icon) that root FS is more than 70% in use (that is my setup).
>>> Went to check what occupies so much space, and found:
>>> $ pfexec du -sch /*
>>> ...
>>> 76G     /proc
>>
>> /proc is a virtual file system of its own and doesn't use space in your ZFS
>> pool, so you'll need to look somewhere else to find out what's filling your
>> root FS.
>>
>> 	-alan-
>>
> 
> 
> Not only that, but du on /proc is probably misleading.  pmap -x    PID  (for one or more actual PIDs)  will probably be more informative.  Keep in mind that shared mappings may appear in many processes, but only consume memory once.
> 
> As for real storage, my favorite du commands are either
> 
> du -doh / | gsort -k1hbr
> 
> or
> 
> gdu -xSh / | gsort -k1hbr
> 
> which do not cross filesystem boundaries, do not include subdirectory totals in a directory's total, and present totals in easier to read scaled units; gsort is also able to sort on scaled units.  This allows spotting the directories that contain directly within them the largest file space totals.
> 
> The only thing that doesn't do, is it does not report files that are open but deleted (which will disappear when nothing holds them open any more).  Any way to find those is going to be rather devious, and beyond what I'd mention here.  One possibility won't be reported by any tool, not even by inspecting /proc/*/fd/* or /proc/*/object/*, and that's if some ignorant person has deleted the currently in-use process accounting file, usually /var/adm/pacct, which is held open not by any process (so no reference will appear in /proc or would be found even if one built a working version of lsof), but by the kernel itself; the fact of that can only be discovered by someone knowledgeable enough to do so using a debugger on the running kernel.
> 

Indeed, both examples from above were found abandoned log file...
Many thanks for that useful set of commands.

With best regards.
Predrag Zečević

-- 
Predrag Zečević
Technical Support Analyst
2e Systems GmbH

tel: +49 - 6196 - 95058 - 15
mob: +49 - 174 - 3109288
fax: +49 - 6196 - 95058 - 94
e-mail: predrag.zecevic at 2e-systems.com

headquarter: 2e Systems GmbH, Koenigsteiner Str. 87, 65812 Bad Soden am 
Taunus, Germany
registration: Amtsgericht Koenigstein (Germany), HRB 7303
managing director: Phil Douglas

http://www.2e-systems.com/ - Making your business fly!