In my Cube running 10.3.9 I have a 19 GB harddisk. It's currently 98% full with 18.6 GB occupied.
oswald:/usr/bin root# df -k Filesystem 1K-blocks Used Avail Capacity Mounted on /dev/disk0s3 19908432 19276288 433060 98% /but when I run du -sh on / (as root) to check where the space is used
| du -sh | Name | Finder Information |
|---|---|---|
| 8.8G | Users | 8.82 GB |
| 1.1G | System | 1.06 GB |
| 745M | usr | |
| 480M | Library | 371 MB |
| 301M | Applications | 300 MB |
| 141M | private | |
| 82M | Developer | |
| 3.7M | mach_kernel | |
| some more small stuff | ||
all this adds up to approximately 12GB. So where is the rest ?
Peculiarily the Finder and du differ by 110 MB on my Library folder. Is this because the other files are owned by other users ?
It could be that after deleting a ZIP file of a mere 6 GB, using the Finder, something might have broke inside HFS+. Or maybe the log of the journalling filesystem was not properly cleaned up ?
Another possibility is, that my box has been opened up and that a root kit was installed. But when I looked at the WeaponX source code, I thought, it should be fairly easy to trick a root kit, based on that code, to reveal itself. I tried, but I didn't find anything.
Solution ? I rebooted. Mac OS X cleaned itself up, I suspect it was the log:
oswald:~ nat$ df Filesystem 512-blocks Used Avail Capacity Mounted on /dev/disk0s3 39816864 25264232 14154464 64% /