OK, My /usr partition starts delivering warnings in cpanel. I'm hitting 81% full. Then it starts to grow last couple of days to 83 creeping up 84 , 86...then last night 93% !!

This morning it goes down spontaneously to 81%...

In the meantime I had noticed a couple of files that were not getting rotated. I deleted them. 300 megabytes each. The directory is /usr/local/apache/domlogs and /usr/local/apache/logs.

Do a df -k. NO CHANGE AT ALL! I have no idea what caused the gain or drop in usage but deleting known HUGE files has no impact.

So naturally I'm worried for the worst. That it could be a rootkit installed and that df -k is giving out wrong values? I installed that rootkit checker and all it came back with was the portsentry warning and the usual list of .pack files that are suspicious...

Should I be worried?

Thanks!

BTW, not that it matters with those rootkits, but here is:

# ls -l df
-rwxr-xr-x 1 root root 26376 Jan 19 07:04 df*

Now it shows up as 64% full. So there's a delayed response in df -k???? Isn't it supposed instant? So confused :confused: :confused: :confused: :confused:

Make sure you are not following sysmlinks thorugh the filesystem.

Also try a du -sh * on the dir to get an idea of the size. If your system is bogged down, df can be slow.

I didn't see any simlinks at all. I did use "du" to find those logfiles. Just to clarify, when you say "df" can be slow, you mean slow in terms of catching up to the actual filesizes? Or responding to the command?

Not sure, does df query the database or does it actually look at all the files to determine their size? The database i.e. what is used when you use find is only updated twice a day that's why you can find (or is it locate?) really fast but sometimes the info is old.

Remembering some textbook info so correct me where I'm wrong