On Friday, July 12, 2019 4:28 PM, Theodore Ts'o <tytso@xxxxxxx> wrote: > To: Thomas Walker <Thomas.Walker@xxxxxxxxxxxx> > Cc: Geoffrey Thomas <Geoffrey.Thomas@xxxxxxxxxxxx>; 'Jan Kara' > <jack@xxxxxxx>; 'linux-ext4@xxxxxxxxxxxxxxx' <linux-ext4@xxxxxxxxxxxxxxx>; > Darrick J. Wong <darrick.wong@xxxxxxxxxx> > Subject: Re: Phantom full ext4 root filesystems on 4.1 through 4.14 > kernels > > On Fri, Jul 12, 2019 at 03:19:03PM -0400, Thomas Walker wrote: > > Clearing orphaned inode 1048838 (uid=0, gid=4, mode=0100640, > size=39006841856) > > > Of particular note, ino 1048838 matches the size of the space that we > "lost". > > Hmmm... what's gid 4? Is that a hint of where the inode might have come > from? Good call, gid 4 is `adm`. And now that we have an inode number we can see the file's contents, it's from /var/log/account. I bet that this is acct(2) holding onto a reference in some weird way (possibly involving logrotate?), which also explains why we couldn't find a userspace process holding onto the inode. We'll investigate a bit.... Thanks, -- Geoffrey Thomas geofft@xxxxxxxxxxxx
