模拟：
seq 500000000 >>/var/log/messages
磁盘空间不足-满了
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 6.1G 2.3G 74% /
tmpfs 931M 0 931M 0% /dev/shm
/dev/sda1 190M 40M 141M 22% /boot
/dev/sdc 73K 14K 55K 21% /app/logs
排查哪里站的地方大
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 6.1G 2.3G 74% /
tmpfs 931M 0 931M 0% /dev/shm
/dev/sda1 190M 40M 141M 22% /boot
/dev/sdc 73K 14K 55K 21% /app/logs
du -sh /* |grep G
du: cannot access `/proc/24690/task/24690/fd/4': No such file or directory
du: cannot access `/proc/24690/task/24690/fdinfo/4': No such file or directory
du: cannot access `/proc/24690/fd/4': No such file or directory
du: cannot access `/proc/24690/fdinfo/4': No such file or directory
1.1G /usr
4.7G /var
du -sh /var/* |grep G
4.6G /var/log
du -sh /var/log/* |grep G
4.6G /var/log/messages
ls -lh /var/log/messages
-rw------- 1 root root 4.6G May 20 16:36 /var/log/messages
删除占地大的文件-确认好
m -f /var/log/messages
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 6.1G 2.3G 74% /
tmpfs 931M 0 931M 0% /dev/shm
/dev/sda1 190M 40M 141M 22% /boot
/dev/sdc 73K 14K 55K 21% /app/logs
删除失败
- 硬链接数为零 rm
- 进程调用数为零
谁在使用已经被删除的 /var/log/messages
lsof |grep messages
rsyslogd 1248 root 1w REG 8,3 4888889152 140769 /var/log/messages (deleted)
重启对应的软件rsyslogd
/etc/init.d/rsyslog restart
df -h
/dev/sda3 8.8G 1.6G 6.8G 19% /
tmpfs 931M 0 931M 0% /dev/shm
/dev/sda1 190M 40M 141M 22% /boot
/dev/sdc 73K 14K 55K 21% /app/lo
一个文件被彻底删除条件（文件删除原理）
硬链接数为零 rm
进程调用数为零 lsof 文件 或 lsof |grep 文件