What is filling my Raspberry Pi SD Card up?

Question

I have had the pi running for only a week or so. Hardened it up a bit, installed nextcloud (storing it's data on an external USB HDD) and noticed yesterday that the SD card is full.

I uninstalled a load of stuff to free up some space and it's filling up again!

Please help me work out why/what is filling it up and help me stop it :-)

Here are some details: My Pi Specification Model: Raspberry Pi 3 Model B V1.2 2015 SD Card: 16GB with NOOBS so 14GB partition for the OS OS: Raspbrian Jessie

My biggest question is why the discrepancy between df saying I've used nearly al the 14GB and ncdu saying I've only got 3.7GB of files. Here are some screenshots that might illuminate things:

Ah - can't do more than 2 links. I'll see if I can do the next one by text:

Prompt: sudo find . -printf '\''%s %p\n'\''| sort -nr | grep -v ./media | head -10
find: `./proc/3155/task/3155/fd/5': No such file or directory
find: `./proc/3155/task/3155/fdinfo/5': No such file or directory
find: `./proc/3155/fd/5': No such file or directory
find: `./proc/3155/fdinfo/5': No such file or directory
596770750 ./home/pidavid/hugemovie.mov
172482560 ./usr/lib/chromium-browser/chromium-browser
104857600 ./var/swap
61661823 ./var/lib/apt/lists/mirrordirector.raspbian.org_raspbian_dists_stretch_main_binary-armhf_Packages
51759412 ./usr/lib/electron/electron
50122807 ./var/lib/apt/lists/mirrordirector.raspbian.org_raspbian_dists_jessie_main_binary-armhf_Packages
44040192 ./var/lib/mysql/ibdata1
40582964 ./usr/lib/arm-linux-gnueabihf/libLLVM-3.9.so.1
40208080 ./var/cache/apt/pkgcache.bin
40187546 ./var/cache/apt/srcpkgcache.bin

This shows the swap file being the biggest at 100MB.

I'm at a loss at the moment. I hope you can help.

Thanks

David

Answer 1

Are you emptying your trash? If you are putting stuff into the trash bin, but not emptying it, the files are still taking up space.

Answer 2

First lets see if the data is still named in the filesystem. What do you get when you run sudo du -xsh /? This will give the size of the data that can be seen walking the root filesystem. If this is significantly less than the 12G that df reports, then it could be due to removed files.

If so, you might try running this from the shell: sudo perl -MFile::Find -e 'sub wanted {if (-l $_) {$t = readlink "$File::Find::name"; if ($File::Find::name =~ m!/fd/! and $t =~ /\(deleted\)$/) {@file = stat($File::Find::name); if ($file[3] == 0 and $file[12] > 0) {print "$file[12] - $t\n"}}}} find(\&wanted, "/proc/");'

This will look for file descriptors in /proc that point to deleted files. If those files have no remaining links and size is greater than zero, it will print the number of blocks and the former name of the file. If you see several large files there, show the output. As an example on my machine, it found a test file that I deleted while open:

$ sudo perl  -MFile::Find -e 'sub wanted {if (-l $_) {$t = readlink "$File::Find::name"; if ($File::Find::name =~ m!/fd/! and $t =~ /\(deleted\)$/) {@file = stat($File::Find::name); if ($file[3] == 0 and $file[12] > 0) {print "$file[12] - $t\n"}}}} find(\&wanted, "/proc/");'
8 - /tmp/foobar (deleted)
8 - /tmp/foobar (deleted)

Answer 3

You may also wanna run apt clean to remove downloaded packages during updates.