Curious why "/" filled up yesterday [Solved]

[srq2625]

QSI and "df -h" output below for those that are interested.

Funny thing happened yesterday and if anyone has any insight - I'm all ears.

I got notified that my "/" partition had less than 200MB left. I thought this was strange as that partition was configured to 20GB and in more than 10 years with Linux (yes, I'm a relative noobie) I've NEVER had a problem with that configuration.

So I backed up my /home, booted the computer to a "Live" system, and used gparted to shrink /dev/sda4 by 20GB and expand /dev/sda2 by a similar amount (for some reason I can not explain, there is no /dev/sda3). Worked great and had no problems booting up the system afterward and /home was/is completely intact.

While I am not terribly concerned (unless I notice that "/" continues to grow), I have to wonder why I need more than 20GB for "/". The swap file (/swap/swap) is exactly 4GB - 4294967296 bytes) but I have been working under the assumption that the file is completely allocated when created so I don't think it has suddenly grown in size. Besides, I've not been doing anything that requires swap - I have 16GB of RAM.

Output from "df -h" - as it is now

Code: Select all

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       256M  556K  256M   1% /boot/efi
/dev/sda2        40G   19G   19G  49% /
/dev/sda4       418G  250G  148G  63% /home

Quick System Info:

Code: Select all

System:
  Kernel: 6.1.0-10-amd64 [6.1.38-2] arch: x86_64 bits: 64 compiler: gcc v: 12.2.0
    parameters: BOOT_IMAGE=/boot/vmlinuz-6.1.0-10-amd64 root=UUID=<filter> ro
  Desktop: KDE Plasma v: 5.27.5 wm: kwin_x11 vt: 7 dm: SDDM Distro: MX-23.1_KDE_x64 Libretto
    July 31 2023 base: Debian GNU/Linux 12 (bookworm)
Machine:
  Type: Desktop Mobo: ASUSTeK model: PRIME B450-PLUS v: Rev X.0x serial: <superuser required>
    UEFI: American Megatrends v: 3211 date: 08/10/2021
Battery:
  Device-1: hidpp_battery_0 model: Logitech Marathon Mouse/Performance Plus M705 serial: <filter>
    charge: 55% (should be ignored) rechargeable: yes status: discharging
CPU:
  Info: model: AMD Ryzen 7 2700 bits: 64 type: MT MCP arch: Zen+ gen: 2 level: v3 note: check
    built: 2018-21 process: GF 12nm family: 0x17 (23) model-id: 8 stepping: 2 microcode: 0x800820D
  Topology: cpus: 1x cores: 8 tpc: 2 threads: 16 smt: enabled cache: L1: 768 KiB
    desc: d-8x32 KiB; i-8x64 KiB L2: 4 MiB desc: 8x512 KiB L3: 16 MiB desc: 2x8 MiB
  Speed (MHz): avg: 1506 high: 1550 min/max: 1550/3400 boost: disabled scaling:
    driver: acpi-cpufreq governor: ondemand cores: 1: 1550 2: 1550 3: 1550 4: 1550 5: 1550 6: 1378
    7: 1550 8: 1550 9: 1550 10: 1550 11: 1550 12: 1550 13: 1378 14: 1550 15: 1378 16: 1376
    bogomips: 108798
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
  Vulnerabilities:
  Type: itlb_multihit status: Not affected
  Type: l1tf status: Not affected
  Type: mds status: Not affected
  Type: meltdown status: Not affected
  Type: mmio_stale_data status: Not affected
  Type: retbleed mitigation: untrained return thunk; SMT vulnerable
  Type: spec_store_bypass mitigation: Speculative Store Bypass disabled via prctl
  Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization
  Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, STIBP: disabled, RSB filling,
    PBRSB-eIBRS: Not affected
  Type: srbds status: Not affected
  Type: tsx_async_abort status: Not affected
Graphics:
  Device-1: AMD Turks PRO [Radeon HD 6570/7570/8550 / R5 230] driver: radeon v: kernel
    alternate: amdgpu arch: TeraScale-2 code: Evergreen process: TSMC 32-40nm built: 2009-15 pcie:
    gen: 2 speed: 5 GT/s lanes: 16 ports: active: HDMI-A-1,HDMI-A-2 empty: VGA-1 bus-ID: 08:00.0
    chip-ID: 1002:6759 class-ID: 0300 temp: 33.5 C
  Display: x11 server: X.Org v: 1.21.1.7 with: Xwayland v: 22.1.9 compositor: kwin_x11 driver: X:
    loaded: radeon unloaded: fbdev,modesetting,vesa dri: r600 gpu: radeon display-ID: :0 screens: 1
  Screen-1: 0 s-res: 3840x1080 s-dpi: 96 s-size: 1016x285mm (40.00x11.22")
    s-diag: 1055mm (41.54")
  Monitor-1: HDMI-A-1 mapped: HDMI-0 pos: primary,left model: 22N1 serial: <filter> built: 2022
    res: 1920x1080 hz: 60 dpi: 102 gamma: 1.2 size: 476x268mm (18.74x10.55") diag: 546mm (21.5")
    ratio: 16:9 modes: max: 1920x1080 min: 720x400
  Monitor-2: HDMI-A-2 mapped: HDMI-1 pos: right model: 22N1 serial: <filter> built: 2022
    res: 1920x1080 hz: 60 dpi: 102 gamma: 1.2 size: 476x268mm (18.74x10.55") diag: 546mm (21.5")
    ratio: 16:9 modes: max: 1920x1080 min: 720x400
  API: OpenGL v: 4.5 Mesa 23.1.2-1~mx23ahs renderer: AMD TURKS (DRM 2.50.0 / 6.1.0-10-amd64 LLVM
    15.0.6) direct-render: Yes
Audio:
  Device-1: AMD Turks HDMI Audio [Radeon HD 6500/6600 / 6700M Series] driver: snd_hda_intel
    v: kernel pcie: gen: 2 speed: 5 GT/s lanes: 16 bus-ID: 08:00.1 chip-ID: 1002:aa90 class-ID: 0403
  Device-2: AMD Family 17h HD Audio vendor: ASUSTeK driver: snd_hda_intel v: kernel pcie: gen: 3
    speed: 8 GT/s lanes: 16 bus-ID: 0a:00.3 chip-ID: 1022:1457 class-ID: 0403
  API: ALSA v: k6.1.0-10-amd64 status: kernel-api tools: alsamixer,amixer
  Server-1: PipeWire v: 0.3.65 status: active with: 1: pipewire-pulse status: active
    2: wireplumber status: active 3: pipewire-alsa type: plugin 4: pw-jack type: plugin
    tools: pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet vendor: ASUSTeK PRIME B450M-A
    driver: r8169 v: kernel pcie: gen: 1 speed: 2.5 GT/s lanes: 1 port: f000 bus-ID: 03:00.0
    chip-ID: 10ec:8168 class-ID: 0200
  IF: eth0 state: down mac: <filter>
  Device-2: Intel Wireless 8260 driver: iwlwifi v: kernel modules: wl pcie: gen: 1
    speed: 2.5 GT/s lanes: 1 bus-ID: 06:00.0 chip-ID: 8086:24f3 class-ID: 0280
  IF: wlan0 state: up mac: <filter>
Bluetooth:
  Device-1: Intel Bluetooth wireless interface type: USB driver: btusb v: 0.8 bus-ID: 1-6:2
    chip-ID: 8087:0a2b class-ID: e001
  Report: hciconfig ID: hci0 rfk-id: 1 state: down bt-service: N/A rfk-block: hardware: no
    software: no address: <filter>
  Info: acl-mtu: 1021:4 sco-mtu: 96:6 link-policy: rswitch sniff link-mode: peripheral accept
Drives:
  Local Storage: total: 465.76 GiB used: 268.13 GiB (57.6%)
  SMART Message: Unable to run smartctl. Root privileges required.
  ID-1: /dev/sda maj-min: 8:0 vendor: Samsung model: SSD 860 EVO 500GB size: 465.76 GiB
    block-size: physical: 512 B logical: 512 B speed: 6.0 Gb/s type: SSD serial: <filter> rev: 1B6Q
    scheme: GPT
Partition:
  ID-1: / raw-size: 40 GiB size: 39.2 GiB (98.00%) used: 18.22 GiB (46.5%) fs: ext4 dev: /dev/sda2
    maj-min: 8:2
  ID-2: /boot/efi raw-size: 256 MiB size: 255.7 MiB (99.89%) used: 556 KiB (0.2%) fs: vfat
    dev: /dev/sda1 maj-min: 8:1
  ID-3: /home raw-size: 425.51 GiB size: 417.76 GiB (98.18%) used: 249.2 GiB (59.7%) fs: ext4
    dev: /dev/sda4 maj-min: 8:4
Swap:
  Kernel: swappiness: 15 (default 60) cache-pressure: 100 (default)
  ID-1: swap-1 type: file size: 4 GiB used: 0 KiB (0.0%) priority: -2 file: /swap/swap
Sensors:
  System Temperatures: cpu: 19.0 C mobo: N/A gpu: radeon temp: 33.5 C
  Fan Speeds (RPM): N/A
Repos:
  Packages: pm: dpkg pkgs: 2599 libs: 1424 tools: apt,apt-get,aptitude,nala pm: rpm pkgs: 0
    pm: flatpak pkgs: 0
  No active apt repos in: /etc/apt/sources.list
  Active apt repos in: /etc/apt/sources.list.d/brave-browser-release.list
    1: deb [arch=amd64] https://brave-browser-apt-release.s3.brave.com/ bullseye main
  Active apt repos in: /etc/apt/sources.list.d/debian-stable-updates.list
    1: deb http://deb.debian.org/debian bookworm-updates main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/debian.list
    1: deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
    2: deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware
  Active apt repos in: /etc/apt/sources.list.d/google-chrome.list
    1: deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main
  Active apt repos in: /etc/apt/sources.list.d/mx.list
    1: deb http://ftp.osuosl.org/pub/mxlinux/mx/repo/ bookworm main non-free
    2: deb http://ftp.osuosl.org/pub/mxlinux/mx/repo/ bookworm ahs
Info:
  Processes: 397 Uptime: 2m wakeups: 3 Memory: 15.53 GiB used: 2.2 GiB (14.2%) Init: SysVinit
  v: 3.06 runlevel: 5 default: graphical tool: systemctl Compilers: gcc: 12.2.0 alt: 12
  Client: shell wrapper v: 5.2.15-release inxi: 3.3.26
Boot Mode: UEFI

[Charlie Brown]

"Disk Usage Analyzer" from menu.

Also sometimes log files do that (in case there's something that makes them grow like crazy, normally they're just KBs or MBs )

[j2mcgreg]

The usual culprit for one of theses 'sudden events' is a runaway logging function in one of your applications. You can prevent this from happening in future by putting "/var/log" in a separate one or two Gb partition of its own

[DukeComposed]

"Disk Usage Analyzer" from menu.

QDirStat is also another useful GUI application that works similarly. And when all else fails, "sudo du -s /* | sort -rn | head" will work in a pinch.

[MXRobo]

Maybe, just maybe:

in more than 10 years with Linux (yes, I'm a relative noobie) I've NEVER had a problem with that configuration.

My df -h:

Code: Select all

/dev/sda2        24G   15G  7.6G  66% /

and I remove many apps before I realized that I had to resize some partitions.

[CharlesV]

Just going to mention, I posted in a similar topic a few minutes ago about this:

Not sure if this has anything to do with it.. but since updating this morning (updates from day before or yesterday).. my .xsession-errors has been logging the same error up to 20 errors per second.

I have never seen this before.

(Thunar:6575): GVFS-WARNING **: 11:57:51.506: can't init metadata tree /home/charge/.local/share/gvfs-metadata/home: open: Permission denied

[srq2625]

The usual culprit for one of theses 'sudden events' is a runaway logging function in one of your applications. You can prevent this from happening in future by putting "/var/log" in a separate one or two Gb partition of its own

Well, it doesn't appear to be a run-away logging function:

Code: Select all

$ sudo du -sh /var/log
7.2M    /var/log

[srq2625]

It would not appear that there is anything "strange" going on. I just don't get it - why 20GB is not longer sufficient.

BTW - I ran

Code: Select all

sudo apt autoclean

as it seemed to be harmless enough.

[srq2625]

Just going to mention, I posted in a similar topic a few minutes ago about this:

Not sure if this has anything to do with it.. but since updating this morning (updates from day before or yesterday).. my .xsession-errors has been logging the same error up to 20 errors per second.

I have never seen this before.

(Thunar:6575): GVFS-WARNING **: 11:57:51.506: can't init metadata tree /home/charge/.local/share/gvfs-metadata/home: open: Permission denied

I don't think this has anything to do with my situation as my /home is on a partition different from "/".

Thanks for the thought!

[srq2625]

I think I'm just going to go on with my life and keep a watchful eye on "/". I will re-visit if something untoward starts happening.

Thanks everyone for you kind attention and thoughts.

Marking this solved.