Home / ubuntu / Questions / 852049
Accepted
Aaron Franke
Asked: 2016-11-22 11:48:22 +0800 CST

My root partition keeps filling to 100% capacity, but I can't figure out why!

  • 772

Please see Edit #3 if you're looking for a solution.

I'm running Xubuntu 16.04 LTS, and I have a ~40 GB root partition which is 100% full according to System Monitor (as root). It's definitely full, since many programs aren't functioning correctly.

System Monitor Disk Usage

However, for some reason, I can't seem to figure out what is using the space! Baobab (as root) only reports a total of 15.5 GB used on my root partition!

Baobab Disk Usage

EDIT: Also, here's /var - people said that it's big. Baobab only reports 1 GB for /var, and /var/log is empty. I've tried running sudo rm -R /var/log and there was no effect.

enter image description here

So, how do I find out what is using my disk space, and how do I prevent it from filling up my root partition? This is a huge problem, please help! Thank you in advance :)

EDIT 2: As posted in the answer section, sudo lsof / | awk '{if(\$7 > 1048576) print \$7/1048576 \"MB\" \" \" \$9 }' | sort -n -u returns 11222.7MB /var/log/kern.log 11222.9MB /var/log/syslog, however, I can't seem to figure out how to delete these files, and additionally, I would like to figure out how I can permanently prevent these files from growing this large. This answer to another question suggested that I look into the logs and see what's filling them up, so ideally I'd like some way to read the contents of these mystery files.

EDIT 3: I have temporarily fixed this issue by mounting /var/log on a separate partition.

However, there is still some kind of bug that's causing this. Please, if you want this bug to be fixed, please bring information (or at least give attention) to the bug reports: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1643719 and https://bugzilla.kernel.org/show_bug.cgi?id=188331 Thank you :)

disk-usage

4 Answers

  1. Best Answer

    There are two types of file access that use disk space, but don't show up with your tools: deleted (but still open) files, and files being written to.

    I have these two aliases defined that I find very useful: 

    # from http://www.certpal.com/blogs/2010/12/find-open-files-in-linux-using-lsof/
alias bigopenfiles="sudo lsof / | awk '{if(\$7 > 1048576) print \$7/1048576 \"MB\" \" \" \$9 }' | sort -n -u" 

alias deletedfiles="sudo lsof / | egrep 'PID|\(deleted\)'"
    • 7

  2. Your /var is very fat. Check /var/log

    You can use this command to find big files :

    sudo find /var -xdev -type f -size +500000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'

    of course you can adjust the size (500000k in this sample)

    After that, you can remove or compress them

    • 2

  3. You're likely not seeing it with your tools because the file is open. Try this as root

    > /var/log/syslog

    Exactly, including the >. This will truncate the log.

    NOTE:

    • This WILL erase the log!
    • 2

  4. As @waltinator told here if you find your deleted syslog files occupying more space even after deleting them and if you can't free it with rm -R /var/log or > /var/log/syslog, kill the Syslog daemon, (in Elementary OS (Ubuntu 18.04), I did killall rsyslogd to release the open files and freed around 15Gb of / space)

    It would be better to mount /var in a separate partition if you've one.

    • 0