How can I see what is consuming space underneath a mounted partition?

环境

• Red Hat Enterprise Linux (RHEL) all versions

问题

• My partitions are arranged like this (example):

Raw

/ (/dev/sda1)
--/var (/dev/sda2)
--/usr (/dev/sda3)
--/backups (/dev/sda4)

• My root partition itself (/dev/sda1) is small, and is almost full.
• There is nothing on any directory that might account for the occuppied space.
• How can I see where is the consumed space, and free it by deleting files?

决议

The following can be used only to view that is consuming space underneath the mounted partitions. You will not be able to mount the root filesystem read-only on another location, if it is already mounted read-write on /. As such, please exercise extreme care when doing the following procedure, and ensure filesystem activity is kept at a minimum. Failure to do so can incur in filesystem corruption.

1. Create an alternative directory where the root filesystem will be mounted:

   Raw

   # mkdir /image
   

2. Mount the root filesystem on said directory:

   Raw

   # mount /dev/sda1 /image
   

3. Execute du command inside that mounted filesystem:

   Raw

   # cd /image
   # du -sh *
   

4. To ensure data corruption does not occur, immediately unmount the root filesystem at /image:

   Raw

   # cd /
   # umount /image
   

Note that, based on the example above, there should not be any files inside /image/usr, /image/var and /image/backups. However, if there are (because files were written there while the partition was not mounted), the output from the du command will show the file sizes of all the top-level directories of the root filesystem, ignoring the mounted partitions (since they are mounted on the respective / childs, not on /image). Based on that output, you will be able to see if any files reside on top-level directories underneath the partitions mounted on them. Once you have this information, you can either:

• Unmount the partition that resides on the offending directory (the one consuming space where it should not), and remove the files manually.
• If it is not possible to unmount the partition, you will have to reboot your system into rescue mode (select "Skip" on step 5 of the mentioned guide), mount the root filesystem manually, and delete the files outlined as per the mentioned procedure.

根源

Due to how the Linux filesystem structure works, if you have a partition mounted on a directory (e.g. /backups), and a file getss written to that directory while the partition was not mounted, the space consumed by said file will account towards space used in its parent directory (in this case, /), instead of the partition that will be mounted there (/backups).