Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently had a problem with .xsession-errors file - it became very big (> 90GB) and took all disk space: How I can check what takes disk space in /tmp?. I cleaned it with command > .xsession-errors but after an hour it became large again. So I deleted it (rm .xsession-errors) - it helped because it wasn't recreated but again after hour disk space disappeared - now there is no .xsession-errors anymore but I don't know where is the memory:

 df
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda1      106640456 101223392         4 100% /
udev             8166744         8   8166736   1% /dev
tmpfs            3270224       972   3269252   1% /run
none                5120         0      5120   0% /run/lock
none             8175552       152   8175400   1% /run/shm

du -sc * .[^.]* | sort -n
0       initrd.img
0       initrd.img.old
0       proc
0       sys
0       vmlinuz
0       vmlinuz.old
4       cdrom
4       lib64
4       media
4       mnt
4       selinux
8       dev
12      srv
16      lost+found
68      tmp
1124    run
3396    lib32
5164    .rpmdb
5540    root
8888    sbin
9120    bin
17132   etc
106080  opt
116956  boot
861908  lib
3530584 usr
3821836 var
13371260        home
21859112        total

So there is around 100GB used but executing du -sc * .[^.]* | sort -n in root directory finds only ~21 GB - so what takes 80GB?? How to check it? I suspect that when I deleted the `.xsession-errors' file the errors were redirected somwhere else - but where?

lsof | ( grep -n 1 '.' ; grep '.xsession-errors' )
    gnome-ses  2748    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-set  2797    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    compiz     2825    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    vino-serv  2836    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    nm-applet  2837    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    bluetooth  2838    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-fal  2839    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    polkit-gn  2844    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    nautilus   2851    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    sh         2901    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gtk-windo  2902    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-ter  3169    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gdu-notif  3235    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    telepathy  3253    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    gnome-scr  3276    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    update-no  3508    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    deja-dup-  3964    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)
    update-ma 25719    someuser    2w      REG                8,1 80997797888    4194313 /home/someuser/.xsession-errors (deleted)

You were right - this file (.xsession-errors) still takes 80GB! The problem is that many programs using it - I looked in internet and many people had this problem (bug) but the best solution I found is to set cron tab job to truncate this file when its too big ... But I can't access file now because it's deleted - I tried to create another .xsession-errors file (very naive huh ;) but it's not the SAME file any more... Now my question is how I cant delete this deleted file or at least restore it to truncate it then...

share|improve this question
1  
If .xsession-errors is growing to > 90GB in an hour, the correct course of action is not to delete it, but find out what the error is and fix it. Try running the command again after cd /var/log. –  Darth Android Oct 18 '12 at 22:21
add comment

1 Answer

up vote 8 down vote accepted

If you delete an open file, the file itself is not deleted, only its name. The space is only reclaimed when the file is closed by whatever process is writing to it, therefore the deleted file continues to exist and to grow.

If a process still has the file open after you 'deleted' it, you can find out what process is using it:

lsof | ( grep -n 1 '.' ; grep '.xsessions-errors' )

The output will be something like this:

COMMAND                PID   USER  FD   TYPE  DEVICE  SIZE/OFF     NODE  NAME
problematic-program   1234  auser   4u   REG   252,2         0  1967438  /home/auser/.xsession-errors (deleted)

To see how much space the 'deleted' file is now taking:

ls -l /proc/1234/fd/4

Where 1234 is the PID shown above, and 4 is the FD. Once you know the problematic-program, you can troubleshoot from there.


Having used lsof to identify a list of programs that have .xsession-errors open for writing, you need to shut down and restart each of those programs. If necessary you can shutdown and restart the system though this isn't strictly necessary.

If a log file grows fast, the ideal solution is to find out why and address that problem (e.g. some resources are missing). However if you prefer you can redirect the errors to /dev/null using the method described at http://askubuntu.com/questions/93718/how-do-i-prevent-xsession-errors-from-eating-disk-space

share|improve this answer
    
I updated my question - it seems that many programs are using this file... How I can restore it or delete completly? –  user166241 Oct 19 '12 at 7:06
    
@user166241: See updated answer but do take note of Darth Android's advice. –  RedGrittyBrick Oct 19 '12 at 9:47
    
@user166241 You need to restart the X server to release the file. All of the programs that are using it are X programs. You can try sudo service restart lightdm, but worst-case you may have to restart the box. I'm presuming it's not a server given that it's running all those X programs. –  Darth Android Oct 19 '12 at 14:40
    
what do u mean "not a server given..."? It is a server for some webservice... –  user166241 Oct 19 '12 at 17:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.