![追踪恶意磁盘使用情况](https://linux22.com/image/639996/%E8%BF%BD%E8%B8%AA%E6%81%B6%E6%84%8F%E7%A3%81%E7%9B%98%E4%BD%BF%E7%94%A8%E6%83%85%E5%86%B5.png)
我发现了其他几个与我的问题背后的理论有关的问题(例如这,这),但我不知道如何将答案应用到我的机器上。
# du -hsx /
11000283 /
# df -kT /
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/mapper/csisv13-root ext4 516032952 361387456 128432532 74% /
11G
(du
)和345G
( )差别很大df
。剩下的在哪儿334G
?
它不在已删除的文件中。只有一个,很短,我为了以防万一把它截断了。剩下的是:
# lsof -a +L1 /
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
zabbix_ag 4902 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4902 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4906 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4906 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4907 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4907 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4908 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4908 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4909 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4909 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4910 zabbix 1w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
zabbix_ag 4910 zabbix 2w REG 252,0 0 0 28836028 /var/log/zabbix-agent/zabbix_agentd.log.1 (deleted)
我重新启动了,看看是否fsck
有任何效果。但是,从来看/var/log/boot.log
,似乎没有问题:
/dev/mapper/server-root: clean, 3936097/32768000 files, 125368568/131064832 blocks
我觉得可能有人过于热心地保留了根空间,于是我检查了主记录:
# tune2fs -l /dev/mapper/server-root
tune2fs 1.42 (29-Nov-2011)
Filesystem volume name: <none>
Last mounted on: /
Filesystem UUID: 86430ade-cea7-46ce-979c-41769a41ecbe
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal ext_attr resize_inode dir_index filetype needs_recovery extent flex_bg sparse_super large_file huge_file uninit_bg dir_nlink extra_isize
Filesystem flags: signed_directory_hash
Default mount options: user_xattr acl
Filesystem state: clean
Errors behavior: Continue
Filesystem OS type: Linux
Inode count: 32768000
Block count: 131064832
Reserved block count: 6553241
Free blocks: 5696264
Free inodes: 28831903
First block: 0
Block size: 4096
Fragment size: 4096
Reserved GDT blocks: 992
Blocks per group: 32768
Fragments per group: 32768
Inodes per group: 8192
Inode blocks per group: 512
Flex block group size: 16
Filesystem created: Fri Feb 1 13:44:04 2013
Last mount time: Tue Aug 19 16:56:13 2014
Last write time: Fri Feb 1 13:51:28 2013
Mount count: 9
Maximum mount count: -1
Last checked: Fri Feb 1 13:44:04 2013
Check interval: 0 (<none>)
Lifetime writes: 1215 GB
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
First inode: 11
Inode size: 256
Required extra isize: 28
Desired extra isize: 28
Journal inode: 8
First orphan inode: 28836028
Default directory hash: half_md4
Directory Hash Seed: bca55ff5-f530-48d1-8347-25c004f66d43
Journal backup: inode blocks
该系统是:
# uname -a
Linux server 3.2.0-67-generic #101-Ubuntu SMP Tue Jul 15 17:46:11 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.2 LTS"
有人能给出一些建议,告诉我如何才能找到并恢复丢失的空间吗?
答案1
我会
- 确保我有备份。
- 从某些实时媒体(例如 Ubuntu 安装程序或 sysrescuecd)启动服务器,然后使用 强制对该文件系统进行彻底的 fsck
e2fsck -f
。