# /dev/sda1 used from 6.2g 13% to 49g 100% in 4 days

**URL:** <https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952>\
**Category:** Logstash\
**Created:** [August 3, 2018, 4:45pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952 "2018-08-03T16:45:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![databeata](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@databeata](https://discuss.elastic.co/u/databeata)\
**Post date:** [August 3, 2018, 4:45pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952/1 "2018-08-03T16:45:58Z")

</div>

The /dev/sda1 used went from 6.2g 13% to 49g 100% in 4 days.

The memory free went from 51g to 2g in 4 days.

How do I manage it?

8/3:  
-- reboot  
-- /dev/sda1 6.2g 13%  
-- memory free 51g

after 4 days.

8/7:  
-- /dev/sda1 49g 100%  
-- memory free 2g

df -h

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/838bf68a1eb566cb6a6db225f848fe7cf3273e71.png)

free -g

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6cbd67237ba6cda7c3e9f59d5821549e9f9a60bf.png)

sudo du --max-depth=1 --human-readable / | sort --human-numeric-sort

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/5/0530003e01274cd937e15f12a637108d14db7975.png)

I have only elk running on this vm.

I have only one logstash job running.

elk is running from /datadrive and not from os drive.

/datadrive/usr\_share\_logstash/logstash/bin/logstash

/datadrive/elasticsearch-6.0.0/bin/elasticsearch

/datadrive/kibana-6.0.0-linux-x86\_64/bin/kibana

path\_logs and path\_data are set to /datadrive and not to os drive.

path.logs: /datadrive/elk/logstash/path\_logs  
path.data: /datadrive/elk/logstash/path\_data

path.logs: /datadrive/elk/elasticsearch/path\_logs  
path.data: /datadrive/elk/elasticsearch/path\_data

logging.dest: /datadrive/elk/kibana/path\_logs/kibana.log  
path.data: /datadrive/elk/kibana/path\_data

ls -lh /datadrive/elk/kibana/path\_logs

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76fe84af77b02583b348ddf884449088fca9256a.png)

ls -lh /datadrive/elk/elasticsearch/path\_logs

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b5437f9fa71e9e167af748ad165ac99044084cb4.png)

ls -lh /datadrive/elk/logstash/path\_logs

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3aa48a36b34a493c48a6b293674cd21eeced55ef.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 3, 2018, 5:00pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952/2 "2018-08-03T17:00:35Z")

</div>

If it magically gets freed up by a reboot then its probably a log file that you have deleted but is held open by a running process. Do you restart logrotate to rotate kibana logs and restart it nightly?

---

<div class="post-metadata">

**Author:** ![databeata](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@databeata](https://discuss.elastic.co/u/databeata)\
**Post date:** [August 3, 2018, 6:22pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952/3 "2018-08-03T18:22:37Z")

</div>

where do I check this? It is not in kibana.yml.

Do you restart logrotate to rotate kibana logs and restart it nightly?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 3, 2018, 6:31pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952/4 "2018-08-03T18:31:15Z")

</div>

Unless you have configured it, it will not be being restarted. You would use an external tool like logrotate to do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2018, 6:31pm UTC](https://discuss.elastic.co/t/dev-sda1-used-from-6-2g-13-to-49g-100-in-4-days/142952/5 "2018-08-31T18:31:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.