[OpenIndiana-discuss] /hipster: question about /proc

[Richard L. Hamilton]

> On Sep 29, 2017, at 11:41, Alan Coopersmith <alan.coopersmith at oracle.com> wrote:
> 
> On 09/29/17 06:55 AM, Predrag Zečević - Technical Support Analyst wrote:
>> Hi all,
>> I got today alert (actually blinking TimeSlider icon) that root FS is more than 70% in use (that is my setup).
>> Went to check what occupies so much space, and found:
>> $ pfexec du -sch /*
>> ...
>> 76G     /proc
> 
> /proc is a virtual file system of its own and doesn't use space in your ZFS
> pool, so you'll need to look somewhere else to find out what's filling your
> root FS.
> 
> 	-alan-
> 


Not only that, but du on /proc is probably misleading.  pmap -x    PID  (for one or more actual PIDs)  will probably be more informative.  Keep in mind that shared mappings may appear in many processes, but only consume memory once.

As for real storage, my favorite du commands are either

du -doh / | gsort -k1hbr

or

gdu -xSh / | gsort -k1hbr

which do not cross filesystem boundaries, do not include subdirectory totals in a directory's total, and present totals in easier to read scaled units; gsort is also able to sort on scaled units.  This allows spotting the directories that contain directly within them the largest file space totals.

The only thing that doesn't do, is it does not report files that are open but deleted (which will disappear when nothing holds them open any more).  Any way to find those is going to be rather devious, and beyond what I'd mention here.  One possibility won't be reported by any tool, not even by inspecting /proc/*/fd/* or /proc/*/object/*, and that's if some ignorant person has deleted the currently in-use process accounting file, usually /var/adm/pacct, which is held open not by any process (so no reference will appear in /proc or would be found even if one built a working version of lsof), but by the kernel itself; the fact of that can only be discovered by someone knowledgeable enough to do so using a debugger on the running kernel.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 874 bytes
Desc: Message signed with OpenPGP
URL: <http://openindiana.org/pipermail/openindiana-discuss/attachments/20170929/8df9d089/attachment.bin>