[ale] Weird filesystem behavior

[James P. Kinney III]

I would recommend to use a known clean ls, ps, and friends. Dig in /dev
and see what turns up. It does look like you've been compromised.

On Tue, 2003-06-17 at 16:11, Jonathan Glass wrote:
> My server is reporting the following from df:
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda5             9.8G  9.6G     0 100% /
> /dev/sda2             152M   22M  122M  16% /boot
> none                  1.7G     0  1.7G   0% /dev/shm
> /dev/sda3             9.7G   36M  9.1G   1% /tmp
> /dev/sda7             9.8G  2.2G  7.2G  23% /usr
> /dev/sda6             9.8G  158M  9.1G   2% /var
> /dev/sda9             497G  211M  471G   1% /mnt/backup
> /dev/sdb3             941G  175G  718G  20% /bio1
> 
> But this from du -sh * at /:
> /]# du -sh *
> 4.0k    InstallSummary.htm
> 5.7M    bin
> 175G   bio1
> 5.8M    boot
> 4.0k    common
> 356k    dev
> 9.4M    etc
> 0       home
> 4.0k    initrd
> 12k     ks.cfg
> 111M    lib
> 16k     lost+found
> 4.0k    misc
> 179M    mnt
> 129M    opt
> du: `proc/4335/fd/3': No such file or directory
> 0       proc
> 2.9M    root
> 9.5M    sbin
> 3.2M    tmp
> 2.2G    usr
> 126M    var
> 
> I don't see 9.6 GB being used.  I cannot find any hidden files, and this
> server's twin doesn't have this problem.  Any thoughts?  The next step
> I'm going to take is to boot off CD and to an 'ls', 'du', and 'df'.
> 
> TIA!
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics) <jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7 

 This is a digitally signed message part