CentOS - Apr 2016 - Suddenly increased my hard disk

Hi Tony and Gordon,
Thanks for your help.
I have tried above your commands
I couldn't see that size of the file.

Usually the qmailbackup created like below format in backup location.

201604151929-backup.tar.gz
201604151929-qmailadminpasswd.tar.bz2
201604151929-qmailcontrolusers.tar.bz2
201604151929-spamassassin-files.tar.bz2
201604151929-squirrelmail-plugins.tar.bz2
201604151929-squirrelmail-prefs.tar.bz2
201604151929-vpopmail.sql.gz
201604151929-vpopmail.tar.bz2

Then i have tried to delete rm -f *.bz2 files or *.gz files.

The above same steps followed on 01 April files.

After that it doesn't show the 201604011929-backup.tar.gz file in backup
location.
but the extra 194 GB size occupied in my server which is above mentioned
backup file size.

I had checked mailbox folder size 386 GB and there is no other big size
folder and files in my server.
But i am wonder why it shows  580GB occupied in my hard disk.

how to find out and solve this issue.
I have run fail2ban and firewall also in my server.
i have doubt anybody hacked or accessed my system from outside.
Could anyone help me.





On Fri, Apr 8, 2016 at 12:45 AM, Gordon Messmer <gordon.messmer at
gmail.com>
wrote:
> On 04/06/2016 10:08 PM, Chandran Manikandan wrote:
>
>> qmailtoaster backup file which was around 184 GB in backup.gz type and
i
>> have removed .bz2 type file with the same backup/mailbkup directory.
>>
>> After removed .bz2 file it's gone backup.gz also which was 184 GB
file.
>> I have run this command locate .gz but couldn't find out it.
>>
>> how do i see the open files.
>>
>
> You're most of the way there.  You've probably identified the
culprit.
> The backup file consumed your space, and some process still has it open so
> that it's not being freed on the filesystem.
>
> As root, look for deleted files:
>
> # ls -l /proc/*/fd/* | grep '(deleted)'
>
> For instance, among the output on my system, I see this:
>
> l-wx------. 1 gmessmer gmessmer 64 Apr  7 09:41 /proc/28087/fd/1 ->
> /home/gmessmer/tmp.1 (deleted)
>
> The file /proc/28087/fd/1 appears as a symlink to a deleted file. In that
> case, the process with PID 28087 has the file open.  I can use
"ps" to
> determine what the process is, and terminate it appropriately.
>
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> https://lists.centos.org/mailman/listinfo/centos
>


-- 
*Thanks,*
*Manikandan.C*
*System Administrator*

On 04/17/2016 09:27 PM, Chandran Manikandan wrote:
> Thanks for your help.
> I have tried above your commands
> I couldn't see that size of the file.
What commands?  I suggested that you look for deleted but open files using:
# ls -l /proc/*/fd/* | grep '(deleted)'

If you see any, you won't see their size.  All you'll really see is the 
PID of the process that has the files open, and in that case, you must 
terminate that process.

Do you see deleted files when you run the command above?

On Mon, April 18, 2016 1:02 pm, Gordon Messmer wrote:
> On 04/17/2016 09:27 PM, Chandran Manikandan wrote:
>> Thanks for your help.
>> I have tried above your commands
>> I couldn't see that size of the file.
>
> What commands?  I suggested that you look for deleted but open files
> using:
> # ls -l /proc/*/fd/* | grep '(deleted)'
>
> If you see any, you won't see their size.  All you'll really see is
the
> PID of the process that has the files open, and in that case, you must
> terminate that process.
>
> Do you see deleted files when you run the command above?
lsof command may be of help either...

Valeri

++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++