Linux – Missing space on /var partition

disk-space-utilizationfilesystemshard drivelinux

One of our server admins asked me to take a look at this, and I am stumped – our /var partition is full, however I cannot seem to determine where the space has gone.

The following is the output of 'du /var -ah'

...
202M    var/

'df -h' however returns

Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/gza-root  268M  108M  147M  43% /
tmpfs                 2.0G     0  2.0G   0% /lib/init/rw
udev                   10M   68K   10M   1% /dev
tmpfs                 2.0G     0  2.0G   0% /dev/shm
/dev/sda1             236M   20M  204M   9% /boot
/dev/mapper/gza-home  115G   15G   95G  14% /home
/dev/mapper/gza-tmp   380M   11M  350M   3% /tmp
/dev/mapper/gza-usr   4.7G  3.9G  610M  87% /usr
/dev/mapper/gza-var   2.9G  2.7G   26M 100% /var

I cannot seem to locate where the other 2.5GB has gone, any ideas or hints?

Best Answer

Try restarting services. It is possible something had a file open on /var when you deleted (rm unlink things, it ) it. The system will not release the space until everything closes their file handles for that file..

You might need to use lsof to find out what program still has the files open in /var.

Since it is /var, I would guess something still has a log file open.