Не могу найти, почему заканчиваются inode

639
Ticksy

У меня есть Xen VPS с Debian Linux, установленный с файловой системой ext4. Однажды я обнаружил, что все иноды используются. Я проверил это:

~# df -i Filesystem Inodes IUsed IFree IUse% Mounted on rootfs 3932160 3932160 0 100% / udev 59227 262 58965 1% /dev tmpfs 63251 215 63036 1% /run /dev/xvda 3932160 3932160 0 100% / tmpfs 63251 2 63249 1% /run/lock tmpfs 63251 2 63249 1% /run/shm 

Затем я попытался найти, где были использованы все иноды. Обычно они использовались сессионными файлами PHP (из-за поломки задачи cron или внутреннего очистителя PHP). Но я не могу найти, какой каталог содержит очень большое количество файлов. Я перепробовал много методов, есть один:

/# for i in /*; do echo $i; find $i |wc -l; done /aquota.group 1 /aquota.user 1 /bin 124 /boot 9 /dev 264 /etc 1746 /home 1 /initrd.img 1 /lib 4002 /lib64 2 /lost+found 1 /media 1 /mnt 1 /opt 1 /proc 26590 /root 17 /run 214 /sbin 127 /selinux 1 /srv 3 /sys 3609 /tmp 1 /usr 37020 /var 8636 /vmlinuz 1  /# mount sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) udev on /dev type devtmpfs (rw,relatime,size=10240k,nr_inodes=59227,mode=755) devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000) tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=50604k,mode=755) /dev/xvda on / type ext4 (rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered,usrquota,grpquota) tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k) tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=101200k)  Filesystem Type 1K-blocks Used Available Use% Mounted on rootfs rootfs 61927420 37390672 21391020 64% / udev devtmpfs 10240 0 10240 0% /dev tmpfs tmpfs 50604 120 50484 1% /run /dev/xvda ext4 61927420 37390672 21391020 64% / tmpfs tmpfs 5120 0 5120 0% /run/lock tmpfs tmpfs 101200 0 101200 0% /run/shm  /# find . | wc -l 78898 

Что я могу делать дальше?

0

1 ответ на вопрос

0
Eirik Fuller

If you want your find command to exclude inodes belonging to other mount points, include -xdev on the find command line. The 78898 at the end of your output is probably more than the total number of files visible to find in the rootfs partition, because it includes files underneath other mount points. This much does not explain the discrepancy you asked about; it just means the actual discrepancy is probably somewhat larger.

The first thing to check is whether you have unlinked open files. The output of the following command, run as root, should show you those:

lsof +L1 

One example of why you might have open unlinked files is processes which began before package upgrades which replaced them with newer files (a couple of sshd processes on one of my systems have open unlinked files). Another possibility is processes which deliberately unlink open files to conceal their contents from other processes.

If that doesn't fully account for the discrepancy, another possibility is that files which have not been deleted are still invisible to the find command because they are hidden underneath other mount points. There are various ways to investigate that possibility, but it probably makes sense to count open deleted files first.

Похожие вопросы