Print-friendly Version

Peeking Under Mount Points

Christopher Cupples, December 2004

Occasionally, a system administrator may encounter a file system on which the disk usage reported by du and df seems inconsistent. As a real-life example, consider a root file system for which df reported:

# df -k /
Filesystem            kbytes    used   avail capacity  Mounted on
/dev/dsk/c1t0d0s0    3008649 2809043  139434    96%    /

However, du could not account for all the usage:

# du -sdk /
2362738

Missing space could be consumed by files actually located in directories that are current mount points. Can the mounted file systems be lifted to peek under the mount points without disturbing the system while it is running in production? Probably not. However, it is possible to use NFS to inspect the underlying directory structure.

First, ensure that the NFS server processes are running:

# /etc/init.d/nfs.server start

Next, export the root file system (with access limited to the local host for security):

# share -o rw=localhost,root=localhost /

Then NFS-mount the exported root file system:

# mount -F nfs localhost:/ /mnt

Now you can start looking at directories that serve as mount points. In the preceding example, the following was quickly discovered:

# cd /mnt
# find export | xargs ls -ld
drwxr-xr-x   9 root     sys          512 Jan 23 13:56 export
drwxr-xr-x   3 root     other        512 Nov 29 15:20 export/home
drwx------   2 root     root         512 Mar 26 16:16 export/home/crash
-rw-r--r--   1 root     root           2 Mar 26 16:16 export/home/crash/bounds
-rw-r--r--   1 root     root      701285 Mar 26 16:16 export/home/crash/unix.0
-rw-r--r--   1 root     root     456032256 Mar 26 16:16 export/home/crash/vmcore.0
drwxr-xr-x   2 root     other        512 Nov 12 17:27 export/home2
drwxr-xr-x   2 root     other        512 Nov 12 17:27 export/home3

Note that the 450 Mbyte crash dump from Mar 26 was actually located on the root file system and not on /export/home as was intended.

Delete the crash dump:

# rm -rf export/home/crash/*

And this restores the missing space:

# df -k /
Filesystem            kbytes    used   avail capacity  Mounted on
/dev/dsk/c1t0d0s0    3008649 2362771  585706    81%    /

Then, the exported root file system can be unmounted and unshared, and the NFS server can be stopped:

# cd /
# umount /mnt
# unshare /
# /etc/init.d/nfs.server stop

The information and links on this page have been provided by a BigAdmin user. The submitter is solely responsible for such information and links. Sun is not responsible for the availability of external sites or resources, and does not endorse and is not responsible or liable for any content, advertising, products, or other materials on or available from such sites or resources. Sun will not be responsible or liable, directly or indirectly, for any actual or alleged damage or loss caused by or in connection with use of or reliance on the information posted here, or goods or services available on or through any external site or resource.