Re: Fwd: How to WIPE Service with D+ STAT

[Rick Stevens <ricks nerd com>]

alok pandey wrote:
> Hi
> Recently I experienced a problem on one of  user-desktop machine
> (centos5.2), when a user(with all access) deleted the file
>  /var/log/messages  to free some space (as  df -h was showing /var 100%
> full), but still df -h shows 100% full.
> It takes around 10 min to figure out the problem. To resolve it, I just
> reloaded the syslog service. ( I was luck that user told me what he did
> before, otherwise I am sure it will  take min of 1 to 2 hour )
>
>
> I want to know that is there any way to get perfect details of such
> misguiding output. (one i know is fuser, but i didn't find it's helpful).
>
> To be more specific about problem I want to know ,Is there any way in
> Linux(centos) to do the following :-
> --Remove/reload/wipe process who's ps output comes with D+ stat
> --How to trace running  script/process  , were it is blocked/hold (basically
> exact line of script)
> --process/users details of using  resource ( disk partition, memory, files,
> etc) .

When you free up space in a directory, all of the files in that
directory must be closed before the free space will appear.  As long as
a program holds an open file there, the free space won't appear.

In your case, syslog was holding /var/log/messages open so the free
space was hidden.  When you restarted syslog, it closed
/var/log/messages allowing the true state of things to appear.  It then
reopened the file and life continues.

----------------------------------------------------------------------
- Rick Stevens, Systems Engineer                      ricks nerd com -
- AIM/Skype: therps2        ICQ: 22643734            Yahoo: origrps2 -
-                                                                    -
-     Better to understand a little than to misunderstand a lot.     -
----------------------------------------------------------------------