[clue-tech] ext3 missing disk space?

[marcus hall]

On Tue, Aug 09, 2005 at 03:25:14PM -0600, Dan Harris wrote:
>Something strange happened today.  I have an ext3 filesystem and I
>deleted a directory that was about 118 gigs in size ( database
>stuff ).  And the command finished instantly.  Sure enough the
>directory is now gone, however 'df' still reports all that disk space
>being used!

On Aug 9, 2005, at 3:24 PM, Nate Duehr wrote:
>That usually means that something still has the file open.

On Tue, Aug 09, 2005 at 03:29:38PM -0600, Dan Harris wrote:
> I've rebooted the box, that should have released it, no?

Well, depending on how you rebooted, it *might* not have.. (see below)

How do you know that the directory contained 118 Gb of data?  Did it just
contain several "large" files (as reported by "ls")?  Especially for a
database, these "large" files may actually be very sparse.  That is, they
only have a few real blocks of data, but the data is not contiguous.  The
size reported by "ls" will be the highest offset that was written data,
but that isn't a true indicator of the number of data blocks allocated to
the file.

Obviously, with the file gone, it's very hard to tell if this was the
case.  It's also difficult to tell if this is the case even with the
file present, because the kernel doesn't readily expose this sort of
information about a file.

If you rebooted the box and ran fsck (or if you can unmount the filesystem
and fsck it), and fsck reports that all is clean (or mostly clean at least),
yet df continues to report little gain for removing such a huge file, I
would guess that the file really was sparse and removing it didn't free
up all that many blocks after all.  If fsck finds lots of missing blocks,
then perhaps you did come across a bug in ext3.  If fsck re-attaches the
file to "lost+found", then some running program may have had the file
open after you deleted it and you rebooted the hard way so that that
process never cleanly exited.  Then fsck found the unreferenced file and
helpfully re-attached it under lost+found.  Check there and potentially
remove it again. (This time hopefully there aren't any other processes
with the file open.)

Marcus Hall
marcus at tuells.org
_______________________________________________
CLUE-tech mailing list
CLUE-tech at cluedenver.org
http://cluedenver.org/mailman/listinfo/clue-tech