2

I recently had a problem with .xsession-errors file - it became very big (> 90GB) and took all disk space: How I can check what takes disk space in /tmp?. I cleaned it with command > .xsession-errors but after an hour it became large again. So I deleted it (rm .xsession-errors) - it helped because it wasn't recreated but again after hour disk space disappeared - now there is no .xsession-errors anymore but I don't know where is the memory:

 df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda1      106640456 101223392         4 100% /
udev             8166744         8   8166736   1% /dev
tmpfs            3270224       972   3269252   1% /run
none                5120         0      5120   0% /run/lock
none             8175552       152   8175400   1% /run/shm

du -sc * .[^.]* | sort -n
0       initrd.img
0       initrd.img.old
0       proc
0       sys
0       vmlinuz
0       vmlinuz.old
4       cdrom
4       lib64
4       media
4       mnt
4       selinux
8       dev
12      srv
16      lost+found
68      tmp
1124    run
3396    lib32
5164    .rpmdb
5540    root
8888    sbin
9120    bin
17132   etc
106080  opt
116956  boot
861908  lib
3530584 usr
3821836 var
13371260        home
21859112        total

So there is around 100GB used but executing du -sc * .[^.]* | sort -n in root directory finds only ~21 GB - so what takes 80GB?? How to check it? I suspect that when I deleted the `.xsession-errors' file the errors were redirected somwhere else - but where? 

lsof | ( grep -n 1 '.' ; grep '.xsession-errors' )
    gnome-ses  2748    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-set  2797    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    compiz     2825    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    vino-serv  2836    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    nm-applet  2837    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    bluetooth  2838    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-fal  2839    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    polkit-gn  2844    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    nautilus   2851    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    sh         2901    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gtk-windo  2902    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-ter  3169    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gdu-notif  3235    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    telepathy  3253    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-scr  3276    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    update-no  3508    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    deja-dup-  3964    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    update-ma 25719    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)

You were right - this file (.xsession-errors) still takes 80GB! The problem is that many programs using it - I looked in internet and many people had this problem (bug) but the best solution I found is to set cron tab job to truncate this file when its too big ... But I can't access file now because it's deleted - I tried to create another .xsession-errors file (very naive huh ;) but it's not the SAME file any more... Now my question is how I cant delete this deleted file or at least restore it to truncate it then...

Community
  • 1
user166241
  • 125
  • 1
  • 2
  • 7

1 Answers1

9

If you delete an open file, the file itself is not deleted, only its name. The space is only reclaimed when the file is closed by whatever process is writing to it, therefore the deleted file continues to exist and to grow.

If a process still has the file open after you 'deleted' it, you can find out what process is using it:

lsof | ( grep -n 1 '.' ; grep '.xsessions-errors' )

The output will be something like this:

COMMAND                PID   USER  FD   TYPE  DEVICE  SIZE/OFF     NODE  NAME
problematic-program   1234  auser   4u   REG   252,2         0  1967438  /home/auser/.xsession-errors (deleted)

To see how much space the 'deleted' file is now taking:

ls -l /proc/1234/fd/4

Where 1234 is the PID shown above, and 4 is the FD. Once you know the problematic-program, you can troubleshoot from there.

Having used lsof to identify a list of programs that have .xsession-errors open for writing, you need to shut down and restart each of those programs. If necessary you can shutdown and restart the system though this isn't strictly necessary.

If a log file grows fast, the ideal solution is to find out why and address that problem (e.g. some resources are missing). However if you prefer you can redirect the errors to /dev/null using the method described at https://askubuntu.com/questions/93718/how-do-i-prevent-xsession-errors-from-eating-disk-space

Community
  • 1
RedGrittyBrick
  • 85,717