HELP: some process eat my /var

[Michael Powell]

Eugen Konkov wrote:

> 
> how to find which process take space?
> 
> 
You might want to look at fstat and lsof. fstat is in system while lsof is 
an add-on third party port. Keep in mind that when you do find the space you 
are looking for it will be held 'open' as an open file in the file system as 
long as the process is running. During normal operations you can shut down 
the process and release the space so it can be deleted. This is relatively 
straightforward as long as everything is 'normal'. The more difficult 
position arises when a process has behaved abnormally, including going 
zombie, crashing, etc. With the 'abnormal' there can be a chance that even 
though the process is gone you may encounter difficulty trying to 
delete/recover the space because the file system still considers it an open 
file.

-Mike