Drive Critical notice reports disk usage higher than when checking manually via SSH

[rhm.geerts]

I get these mails daily from the cpanel server of our client:

From: [email protected]
subject: drivespace critical on server.mydomain.com

The content of the mail reads:
Drive Critical: /dev/sda3 (/) is 93% full

However, if I do a df -h in a root shell I get this:

Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3             448G  176G  249G  42% /
/dev/sda1              99M   17M   77M  18% /boot
tmpfs                 2.0G     0  2.0G   0% /dev/shm
/usr/tmpDSK           3.9G   77M  3.6G   3% /tmp

So the /dev/sda3 is way from being full. Neither are there very big file transfers going on, so it can't get to a sudden more then 40% addition to get this email going.

How can this be fixed?

 

[garrettp]

To my knowledge, cPanel does not cache disk space usage like it does for user disk usage for quotas. You could have a few situations going on that cause the spike in disk usage that cPanel is seeing. One may be due to virfts (jailshell) usage, so I would recommend if possible to jump on your server as soon as you get the notification email and running du against / to see where the usage is coming from.

 

[rhm.geerts]

Oke I will try that next time it occurs again.

Thank you!
Could you give me the exact command to use? Because with du / I get everything.

 

[garrettp]

Try

du -h --max-depth=1 /

 

[rhm.geerts]

Then I get this list:

4.0K    /.cpanel
0       /proc
91M     /etc
292K    /.spamassassin
72K     /dev
5.1M    /scripts
7.3M    /bin
31M     /sbin
12M     /boot
268M    /root
8.0K    /selinux
0       /misc
8.0K    /mnt
8.0K    /media
16K     /lost+found
8.0K    /srv
760M    /backup
1.6G    /var
5.1M    /tmp
0       /net
133M    /lib
0       /sys
7.8G    /usr
25M     /opt
165G    /home
176G    /

I presume when I do this when I get the notice, one of these directory's is probably a lot bigger then 165G?

There is only 1 jailshell account present, which is mine, which is not used anymore.
The only thing I can imagine is the running backup which is made nightly and transfers the backups to another server.

 

[cPanelDon]

I get these mails daily from the cpanel server of our client:

From: [email protected]
subject: drivespace critical on server.mydomain.com

The content of the mail reads:
Drive Critical: /dev/sda3 (/) is 93% full

However, if I do a df -h in a root shell I get this:

Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3             448G  176G  249G  42% /
/dev/sda1              99M   17M   77M  18% /boot
tmpfs                 2.0G     0  2.0G   0% /dev/shm
/usr/tmpDSK           3.9G   77M  3.6G   3% /tmp

So the /dev/sda3 is way from being full. Neither are there very big file transfers going on, so it can't get to a sudden more then 40% addition to get this email going.

How can this be fixed?

Is the same or similar e-mail notice received on a regular basis, such as every day?

Please check the time frames involved and examine the disk space via SSH at or very close to the same time when the e-mail is sent from your server. By inspecting the circumstances at the same time the event occurs there should be more relevant detail available to pinpoint the source(s) of unexpected disk usage.

 

[marianu]

Re: Drive Critical notice reports disk usage higher than when checking manually via S

Do you have cPanel daily backups enabled? If you do the issue might be occurring while backing up the largest account you have in /home. If you have an account of ~60 GB , creating a backup for it would require ~180 GB (3 times more).

You can verify the backup configuration in WHM in the backups area :

https://Yourserver.domain.com:2087/scripts/backupset

Good luck.

 

[rhm.geerts]

Re: Drive Critical notice reports disk usage higher than when checking manually via S

Yes thank you, I have daily backups enabled, but not daily but every 2 days.
I was checking yesterday and already thought about the bacup:

The only thing I can imagine is the running backup which is made nightly and transfers the backups to another server.

Due to the reply's here my thoughts were it was indeed probably not Cpanel but a user account so I checked the logs this night.
It seems one of the owners accounts (which has no limit) has a very big amount of data present, which indeed as you said, could cause this behaviour on backup.
He probably put it there for temporary backup, but forgot that this would also be backupped by Cpanel on this server, causing the problem.

Thank you all for thinking with me, I guess we found the cause.
The owner has been contacted about the files.