寻找被占用的硬盘空间

收到系统邮件报警，有个分区的空间使用率已经超过90%

[root@localhost ~]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda7             4.9G  4.3G  267M  94% /
/dev/sda1              99M   17M   77M  18% /boot
/dev/sda2              43G  8.8G   32G  22% /data
none                  1.9G     0  1.9G   0% /dev/shm
/dev/sda6             4.9G   43M  4.6G   1% /home
/dev/sda5             4.9G  1.8G  2.8G  39% /usr
/dev/sda3             4.9G  1.5G  3.2G  31% /var

[root@localhost ~]# du -h -x --max-depth=1 /
8.0K    /opt
2.0K    /boot
5.7M    /bin
4.0K    /data
0       /proc
144M    /lib
8.0K    /initrd
11M     /etc
8.0K    /mnt
0       /sys
8.0K    /selinux
2.2M    /tmp
42M     /root
8.0K    /var
8.0K    /srv
16K     /lost+found
17M     /sbin
16K     /media
8.0K    /usr
0       /dev
8.0K    /misc
8.0K    /home
4.2G    /

[root@localhost ~]# ls -al /
total 174
drwxr-xr-x   24 root root  4096 Aug 16 01:23 .
drwxr-xr-x   24 root root  4096 Aug 16 01:23 ..
-rw-r--r--    1 root root     0 Aug 16 01:23 .autofsck
drwxr-xr-x    2 root root  4096 Aug 23 04:02 bin
drwxr-xr-x    4 root root  1024 Aug 15 19:12 boot
drwxr-xr-x    5 root root  4096 Sep 20 16:41 data
drwxr-xr-x    9 root root  6540 Aug 16 01:23 dev
drwxr-xr-x   67 root root  4096 Nov  9 14:42 etc
drwxr-xr-x    9 root root  4096 Nov  9 14:42 home
drwxr-xr-x    2 root root  4096 Feb 22  2005 initrd
drwxr-xr-x   12 root root  4096 Oct 26 04:03 lib
drwx------    2 root root 16384 Aug 16 03:43 lost+found
drwxr-xr-x    4 root root  4096 Aug 16 01:23 media
drwxr-xr-x    2 root root  4096 May  3  2007 misc
drwxr-xr-x    2 root root  4096 Aug 15 18:48 mnt
drwxr-xr-x    2 root root  4096 Sep 20 17:07 opt
dr-xr-xr-x  420 root root     0 Aug 16 10:22 proc
drwxr-x---    6 root root  4096 Nov  9 14:42 root
drwxr-xr-x    2 root root 12288 Aug 23 04:02 sbin
drwxr-xr-x    2 root root  4096 Aug 15 18:43 selinux
drwxr-xr-x    2 root root  4096 Feb 22  2005 srv
drwxr-xr-x    9 root root     0 Aug 16 10:22 sys
drwxrwxrwt    4 root root  4096 Nov  9 22:36 tmp
drwxr-xr-x   16 root root  4096 Aug 15 18:45 usr
drwxr-xr-x   22 root root  4096 Aug 21 16:32 var

找来找去，找不到吃掉空间的文件，还是经过好友指点，学到了这个命令：

[root@localhost~]# lsof | grep deleted
logswatch 14767    zimbra    1w      REG        8,7    1830440     384006 /tmp/logswatch.out (deleted)
logswatch 14767    zimbra    2w      REG        8,7    1830440     384006 /tmp/logswatch.out (deleted)
......

意为列出已被删除，但仍被进程占用中的文件。然后就是处理（杀掉？）掉相关进程，释放文件，空间就回来了。