OK, so last night I couldn't upload anything to my server at rackshack (Compaq 1.7 GHz with .5 G Ram, 40 GB hard drive).

I login as root at do df -a, and get this:

/dev/hda3 37349096 35168552 283268 100% /

I have had my logfiles in rotation and deleted for months now, everythign was working fine and the HD was not filling up or anything.

I ran this: du -h --max-depth=1

But it didn't pull up any dirs larger than 2 GB.

I opened a trouble ticket last night, went to bed, and then this morning they hadn't even looked at it. But by this morning the server died (ping, http, ssh, all DOA), and only when I put in a reboot request did they start investigating. (It didn't come back online after rebooting).

Anyone have a mysteriously full drive problem like this? Where's a good place to start investigating ? (Or, should I say where should I have looked were the server still running?)

Core dumps?

I don't know how to check for that. I just investigated all the dirs, and didn't see any that were very big. The largest one found (including the children) was something like 2 or 4 GB.

/

Core dumps will fill root

du -sh /*

Hmm, thanks for the tips. Rackshack fixed it without telling me what happened.

Maybe we helped them =)

TTT - this server is doing the same thing. I am scared. I've opened a RS ticket, hopefully they'll tell me what they do with it this time.

If you have a backup going to that partition that may be the problem.

Whenever I see that happen on a windows box I always assume its been comprimised and is serving out warez to kiddies.

It usualy is.

that happened with me at once... i had zillion of 200-1000b files in /tmp dir - that was a SSL worm... by cleaning /tmp and upgrading ssl version the problem is gone :D

find / -size +10000000c | sort -rn

find / -name \*core

man find