On Saturday 27 September 2008 11:56:16 Colin Brace wrote: > Mel-15 wrote: > > The obvious a file in /, possibly a core dump. > > The less obvious, an open but deleted file. > > Even less obvious, a file in /tmp created in single user mode, without > > /tmp > > mounted. > > My money is on option 2: > > fstat -f / |sort -rnk 8|head > > OK, here is what that returns: > > $ sudo fstat -f / |sort -rnk 8|head > root init 1 text / 16492 -r-xr-xr-x 599320 r > root devd 618 text / 16467 -r-xr-xr-x 334060 r > root dhclient 1192 text / 16469 -r-xr-xr-x 74172 r > _dhcp dhclient 1231 text / 16469 -r-xr-xr-x 74172 r > root fstat 78768 5 / 49687 -rw------- 40960 r > root pflogd 478 text / 16527 -r-xr-xr-x 18716 r > _pflogd pflogd 481 text / 16527 -r-xr-xr-x 18716 r > root adjkerntz 136 text / 16457 -r-xr-xr-x 7244 r > www php-cgi 69281 root / 2 drwxr-xr-x 512 r > www php-cgi 1122 root / 2 drwxr-xr-x 512 r > > Do you see anything that looks unusual?
Nope, and of course not, since it persists over reboot. It must be a directory you're not searching, maybe a dot directory. Best run *in single user mode*, with only / mounted: cd / du -h -d1 . > There is a tutorial here > <http://www.tutorialhero.com/click-42879-moving_freebsd_to_a_new_hard_drive >.php> which explains how to do this using dump and restore. Just curious: > why is this preferable to using plain old cp? Because cp: - will copy foo/bar to dest/oops/bar if dest/foo is a symlink to dest/oops. - does not copy hard links, but both 'files' - cannot make consistent snapshots of a partition -- Mel Problem with today's modular software: they start with the modules and never get to the software part. _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"