Ubuntu root drive running out of space, I can’t find source through du or lsof

disk-space-utilizationUbuntu

The root drive on an Ubuntu 15.10 machine is nearly out of space, but I can't find the source. The drive that's running out of space is sdb2, 313M of 51G available. The filesystem is ext4.

Here is the sudo du -h / --max-depth=1 output:

Filesystem      Size  Used Avail Use% Mounted on
udev            3.9G     0  3.9G   0% /dev
tmpfs           789M  9.4M  780M   2% /run
/dev/sdb2        51G   48G  313M 100% /
tmpfs           3.9G   12K  3.9G   1% /dev/shm
tmpfs           5.0M  4.0K  5.0M   1% /run/lock
tmpfs           3.9G     0  3.9G   0% /sys/fs/cgroup
/dev/sdb1       511M  3.4M  508M   1% /boot/efi
tmpfs           789M  8.0K  789M   1% /run/user/1000
/dev/sda1       239G  122M  239G   1% /media/DATA

But I can't find any large files. Total usage at / seems to be only 3.4 G. Here is the output from sudo du -h / --max-depth=1:

4.0K    /mnt
188K    /tmp
406M    /home
339M    /var
8.1M    /etc
361M    /lib
du: cannot access ‘/proc/7626/task/7626/fd/4’: No such file or directory
du: cannot access ‘/proc/7626/task/7626/fdinfo/4’: No such file or directory
du: cannot access ‘/proc/7626/fd/3’: No such file or directory
du: cannot access ‘/proc/7626/fdinfo/3’: No such file or directory
0    /proc
13M    /bin
du: cannot access ‘/run/user/1000/gvfs’: Permission denied
9.4M    /run
1.6M    /root
4.0K    /lib64
16K    /lost+found
0    /sys
1.1M    /media
12K    /dev
222M    /opt
2.0G    /usr
62M    /boot
9.5M    /sbin
4.0K    /cdrom
8.0K    /srv
3.4G    /

I found a similar question here: Out of disk space, what's the source?

In that case, it looks like the problem was caused by a deleted log that somehow was not closed by a running process, and the way to find it was to run sudo lsof | grep deleted. In my case, the output is

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.

Also, the problem persists after rebooting the system, so it's unlikely that that is the cause.

Another suggested solution is to unmount /var/lib/ureadahead/debugfs, but I'm hesitant to do that.

What else could be wrong?

Best Answer

Well, it's only a guess but it may works: I think that user once forget to mount /dev/sda1 as /media/DATA and all data was written on /dev/sdb2 instead of /dev/sda1.

To check this, please, unmount /media/DATA and check files and folders under this path.

Related Topic