How to check where space is LOST

[Коньков Евгений]

Hi.

I notice that some times /var is overfull

# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad1s1a    496M    239M    217M    52%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad1s1e    124M     40K    114M     0%    /tmp
/dev/ad1s1f    1.8G    1.1G    596M    65%    /usr
/dev/ad1s1d    989M    349M    561M    38%    /var
devfs          1.0K    1.0K      0B   100%    /var/named/dev

# cd /var/

# du -h -d 1
2.0K    ./.snap
2.0K    ./account
6.0K    ./at
2.0K    ./audit
 12K    ./backups
4.0K    ./crash
4.0K    ./cron
2.0K    ./empty
2.0K    ./heimdal
 79M    ./log
 19M    ./mail
4.0K    ./msgs
159K    ./named
2.0K    ./preserve
 60K    ./run
2.0K    ./rwho
 70K    ./spool
 14K    ./tmp
 24K    ./yp
2.0K    ./games
2.0K    ./agentx
 22K    ./net-snmp
4.0K    ./lost+found
 98M    .

If I just #reboot system. I get that on /var is only 98M used.

# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad1s1a    496M    239M    217M    52%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad1s1e    124M     40K    114M     0%    /tmp
/dev/ad1s1f    1.8G    1.1G    596M    65%    /usr
/dev/ad1s1d    989M     98M    891M    12%    /var
devfs          1.0K    1.0K      0B   100%    /var/named/dev

How to obtain what take space on /var

-- 
С уважением,
 Коньков                          mailto:kes-kes at yandex.ru