My disk storage increased over night

[yamaharr1]

My disk storage went from 17% to 47% over night. Where do I begin to find out what files took up so much space in 1 night?

The changes I made since then was I installed the Chirpy firewall.

I looked in the users accounts list and none of them show any big increases.

How do I check to see if it is MySQL or even the email? If it was email then it should show in the users over all account I think.

Any help would be great because by tomorrow my disk will be full

 

[karrotx]

If you installed the Chirpy firewall (APF?), the large increase is, most likely, due to logs. Try turning debugging down.

 

[mctDarren]

CSF (not APF, by the way, that's someone else) logs are doubtful as the culprit so quickly, though you never know. Did you also install the ConfigServer MailScanner set up? High load mail servers can fill up the Mysql database for that set up quite quickly.

Do a scan to see what files are so big:

find '/' -size +70000

 

[yamaharr1]

I found that some of the incresed file storage was because of a mess up with the backups so there where multiple back ups stored in different places they where removed the same day as posting the first message so that still means there is a different of 15GB used within that 24 hours. I also noticed that since I installed chirpy firewall I no longer have access to the admin for fantastico.

I looked through the firewall log files and they are very small.

I do not have the mail scanner installed.

I ran a scan and found most of the files that where found came from the back ups in which I had already known about the others I have listed below if anyone knows if I can remove some of them let me know.

/var/lib/mysql/#sql_1a6b_104.MYD
/var/lib/mysql/#sql_1a6b_96.MYD
/var/lib/mysql/#sql_1a6b_91.MYD
/var/cpanel/perl/easy/Cpanel/Easy/ModJk5.pm.tar.gz
/usr/lib/rpmdb/i386-redhat-linux/CentOS/Packages
/usr/lib/locale/locale-archive
/usr/tmpDSK
/proc/kcore

 

[mctDarren]

The MYD files, locale-archive, tmpDsk and kcore need to stay. You'll probably recover a lot from those MYD files if you optimize those tables in mysql or phpmyadmin.

Try "yum clean" to get rid of the Packages file.

Not certain of the perl module file.. looks like EA related. It's late, so I'm running on fumes, but I don't think you should remove those files until you hear from someone else to confirm I'm correct.

 

[yamaharr1]

"clean" requires an option: headers, packages, cache, metadata, all

I have never used this comand which one should I tell yum to clean?

Thanks

 

[mctDarren]

yum clean all

 

[Kent Brockman]

Maybe the backups are using a bad configuration. I have suffered something similar to this situation before.
Backups files use less space if you set the daily retention only and disable incremental backups. that way, may the backups spend more time building each one, but will be finally compressed, one file a domain, and you'll save much more space

 

[yamaharr1]

I have the back ups all taken care of now it is just that 15GB increase I can not account for.

I don't want to assume it is from the install of the firewall.

 

[Kent Brockman]

did you tried find '/' -size +70000 suggested by serversphere to find out where are the greater files?

This big increase of data happened just one time?

 

[nyjimbo]

Unless I am missing something you dont mention what partition is bigger or what shows you using up the extra gigs. Where is the sudden growth in file usage, what partition ?


Check the contents of /var/spool/exim/db

A couple weeks ago we had a "ratelimit" file in there that suddenly jumped 4 gigabytes in one day. We deleted it and it now grows alot slower. It might be something in there.

 

[yamaharr1]

@ Kent Brockman yes I did and I listed the files in my second post. I also followed "serversphere" next post.

@ nyjimbo that is the problem I do not know where the sudden file usage came from. I have a single 140GB disk with clients that was standing at 17% the last time I checked, then I installed the firewall and the very next day I checked the capacity and it went from 17% to 47% in a manner of 8 hours. I noticed this change because everyday I go into WHM and check drive capacity.

There was a problem with the backups but I have taken care of that and right now I am looking at a lost of 15GB.

All of my client accounts are not holding that many files nor are there plans that big so even if a few clients uploaded files it would be noticable through the client list which I watch everyday.

 

[nyjimbo]

@ nyjimbo that is the problem I do not know where the sudden file usage came from. I have a single 140GB disk with clients that was standing at 17% the last time I checked, then I installed the firewall and the very next day I checked the capacity and it went from 17% to 47% in a manner of 8 hours. I noticed this change because everyday I go into WHM and check drive capacity.
.

Ok, but did you get a chance to do this:

Where is the sudden growth in file usage, what partition ?
Check the contents of /var/spool/exim/db

 

[yamaharr1]

that is the problem I do not know where the sudden file usage came from

I just read your response and I am looking into it now.

 

[yamaharr1]

Check the contents of /var/spool/exim/db

What is it that I should be looking for?

If it is a large file then shouldn't it have turned up when I did what serversphere suggested.

 

[yamaharr1]

I have a "ratelimit" file in there also but when I open it there isn't much info in there.

 

[nyjimbo]

I have a "ratelimit" file in there also but when I open it there isn't much info in there.

Are you familiar with working around in the command prompt?. What we are looking for is file sizes that are in the gigabytes, as per my previous couple of messages. If you are not familiar with how to check this you might want to have someone else look at your computer for you.

 

[yamaharr1]

Unless I am missing something you dont mention what partition is bigger or what shows you using up the extra gigs. Where is the sudden growth in file usage, what partition ?


Check the contents of /var/spool/exim/db

A couple weeks ago we had a "ratelimit" file in there that suddenly jumped 4 gigabytes in one day. We deleted it and it now grows alot slower. It might be something in there.

Ok, but did you get a chance to do this:

Where is the sudden growth in file usage, what partition ?
Check the contents of /var/spool/exim/db

Sorry I didn't see that in your posts and I gave up mind reading years ago


callout 12.0k
misc 12.0k
ratelimit 9.7M
ratelimit.lockfile 0
retry 24.0k
retry.lockfile 0
wait-remote_smtp 12.0k
wait-remote_smtp.lockfile 0