How to clear an improperly unreferenced file in multi-user mode?

[Eric F Crist]

On Nov 3, 2005, at 7:00 AM, Olaf Greve wrote:

> Hi,
>
> When doing some maintenance on my fall-back server I ran into  
> something weird. When running df it turned out /var was for 90%  
> full. I then manually deleted some files (as root over SSH),  
> amongst which the 'maillog' logfiles in /var/log, I also killed  
> sendmail (as it was generating the big log files, and at present I  
> don't need to run it on that machine), and just to be sure I  
> created a new 'maillog file of 0 length.
>
> So far so good, but after removing the maillog files and performing  
> another df call, the available size had not quite dropped as much  
> as expected and as should. DU reports the proper amount of disk  
> usage, so I performed an fsck.
>
...

> Now, of course one way to get rid of that big sucker is to boot the  
> machine in single user mode and run fsck again, however, the box is  
> nowhere near me and I cannot go down to the city where the machine  
> is anytime soon (besides: this is far from an urgent issue). So, I  
> was wondering about a thing: rather than doing a remote reboot and  
> hope that fsck will clear it up in the booting process (if it does  
> that at all, that is), I was wondering if there's a way to fix this  
> when running in multi user mode.
>
> Does anyone know how (if possible) to achieve this, or do I have to  
> reboot the machine in single user mode after all?


I think that if you run a du -hd2 / you'll see that there's probably  
a bunch of crap in /var/ftp.  I found this when I mistakenly enabled  
anonymous FTP.  There were a much of random-sized binaries killing my  
hard drive.

-----
Eric F Crist
Secure Computing Networks
http://www.secure-computing.net