The filesystem and archives

INPUT · Slides

Free space and usage (`df` and `du`)

01 / 08

The number one reason a server stops

Straight to the real world. The most common reason a working server suddenly stops is this.

> the disk filled up

Unable to write, most programs come to a halt. The log cannot be written either, so sometimes not even the cause is left behind.

Worse, it arrives without warning. It grows little by little and one day it is full.

So two tools are provided.

df   look at the free space of **the whole disk** (disk free)du   look at **where** it is going (disk usage)

The names are alike and easy to mix up. Remember them this way.

df = free   -> how much is left?du = usage  -> who used it?

Look at the whole with df first, and when it looks dangerous, hunt the culprit with du. That order.

02 / 08

Look at the whole with df -h

You normally use df with -h (human readable).

~ $ df -hFilesystem      Size  Used Available Use% Mounted ondevtmpfs       10.4M     0     10.4M   0% /devtmpfs          11.1M  4.0K     11.1M   0% /tmphost9p        256.0G     0    256.0G   0% /home/learner

There are only two things to look at.

Use%        the percentage in use (above 90% deserves attention)Mounted on  which place it is

Without -h you get a row of numbers in units of 1K. For a person to read, -h.

Did you notice there are several lines? There is not one disk but several places, divided up.

/dev            the place for devices/tmp            temporary space (in memory!)/home/learner   your room

So when you say "the disk is full", you have to see which one is full. /tmp may be full while your room has plenty.

03 / 08

tmpfs lives in memory

The tmpfs in df -h is a slightly odd thing.

tmpfs   11.1M  4.0K  11.1M  0% /tmp

It is not a disk but space made in memory.

fast (being memory)it vanishes when the power goesits size is a slice of the memory

Last lesson said /tmp is a place that may vanish, and this is the mechanism behind it.

And your home comes out as host9p. That is special to this course: space connected to the outside of the browser (your own computer).

What to hold on to is not the names but the fact that they are kept separate.

/tmp            tmpfs (memory)/home/learner   host9p (other space)

Last lesson ln /etc/passwd was refused with Cross-device link, and this is exactly why. You cannot put a tag on another device.

04 / 08

Look at the breakdown with du

Once you know the free space is short, next comes "who is using it".

~ $ du -sh big.bin20.5K   big.bin

There are only three marks you use much.

MarkMeaning
-sgive only the total (summarize)
-hin a form people read (K / M / G)
-kas a number in units of 1K

Without -s it gives every directory inside, one by one. On a big tree the screen pours past, so you nearly always add -s.

Hand it a directory and it gives you the total of the contents.

~ $ du -sh box11.0K   box

Here is the difference from ls -l.

ls -l   the size of that one file (not counting a directory's contents)du -s   everything inside, added up

Only du can answer "how many megabytes is this folder altogether?"

05 / 08

Three moves to find the culprit

Learn this shape and you can fight with it alone.

~ $ du -sk * | sort -n1       small.txt11      mid.bin21      big.bin

-k puts it in plain numbers and sort -n puts them in order. The bottom one is the culprit.

To pull out just the one:

~ $ du -sk * | sort -n | tail -121      big.bin

The sort -n of chapter 5 with the tail of chapter 2. Join a tool that measures to a tool that sorts with a pipe and you have an investigation.

Do not use -h together with sort -n.

du -sh * | sort -n     <- it does not sort properly (1.5M against 900K)du -sk * | sort -n     <- this is right

-h is a form for people, so the units get mixed and they cannot be compared as numbers. To sort, -k.

06 / 08

Stop at a depth, or go down to the files

When looking at a big tree, stopping at a depth reads better.

~ $ du -d 1 -k .12      ./box44      .

-d 1 means "down to depth 1". It does not give the insides of the insides.

du -d 1 -k /var    compare just what is directly under /var

This tells you at once where in /var the weight is. Go into the heavy directory and look with -d 1 again. Working your way down from the top is the knack.

The other way, when you want every single file, is -a.

~ $ du -ak box11      box/inside.bin12      box

The -a is the a of all.

When you only want the total added up, there is -c.

~ $ du -sc big.bin mid.bin21      big.bin11      mid.bin31      total

A total line goes on the end. Handy for measuring several files together.

07 / 08

The fine detail of the counting

Sometimes ls -l and du do not agree.

~ $ ls -l big.bin... 20480 big.bin      <- 20480 bytes~ $ du -sk big.bin21    big.bin          <- 21 K (about 21504 bytes)

A little bigger. There are two reasons.

1. The disk is used in blocks of a fixed size

Even a one-byte file takes one block (4K, say). So a great many small files eat more than you expect.

2. The bookkeeping needs room as well

The record saying where the data is (the inode again) needs its own place.

There is one more important property.

> du counts a hard link only once

box/a.bin -+           +-> the same contents (21K)box/b.bin -+du -sk box  ->  21 (not 42)

Of course, since there is one set of contents. Last lesson's point comes into the measuring too.

Which is why removing one name does not reduce the total. That is what "I removed it and nothing changed" really is.

08 / 08

Now have a go

This is everything for the lesson.

df -h                     look at all the free spacedf -h .                   just where you aredu -sh name               its size (for people)du -sk name               its size (as a number)du -sk * | sort -n        put them in order of sizedu -d 1 -k .              compare down to depth 1du -ak name               down to the filesdu -sc a b                with the total as well

Learn the trick for making a big file, too.

~ $ head -c 20480 /dev/zero > big.bin

/dev/zero is "the device that gives out 0 for ever", a sibling of the /dev/null (the bin) you saw last lesson. Take as many bytes as you want from it with head -c and drop them into a file.

/dev/null   throws away what you write/dev/zero   read it and 0s come out for ever

That gives you a practice file of any size you like. Now, measure things.