Mysteriously disappearing disk space in V7 (long)

[Larry Campbell]

I have just been totally bamfoozled by something my system did, and would
appreciate any insight anyone could offer on this problem.

System: DEC Rainbow 100 running VENIX/86, a V7 port.

Problem description:

My 33MB disk has 4 partitions: root, /usr, /tmp, and /usr/spool.  The
/usr partition is about 41,000 blocks.  It typically has 10,000 blocks
free.  Last week it "filled up" (quote marks explained soon).  I was
getting "No space on the winchester" messages on the console.  df said
"bad free list", so I rebooted and ran fsck.  Fsck rebuilt the free
list and said zero blocks free.

Now I *knew* I hadn't used up all that disk space so I did some
checking.  du and quot both reported only about 30,000 blocks in use...
11,000 blocks were just not showing up somehow.  I ran fsck again with
-s to force a free list salvage and it again said that all 41,000
blocks were used by files.

I thought fsck -s actually built a bit map of all used blocks by
chasing directories and inodes...  so I don't understand how it could
find 41,000 blocks in files while du and quot only found 30,000.

At this point I had two alternatives.  I could just dump, rebuild, and
restore /usr, which would probably fix the problem.  Or I could try to
figure out what was going on (by writing my own version of fsck, since
I don't have sources).

I had actually decided to try to diagnose it, since I thought it would
probably happen again sooner or later.  This morning I sat down to start
writing my own fsck, ran df to see what shape /usr was in, and:  the space
was BACK!  11,000 blocks free!

The only thing the system has done since I last noticed the space was gone
is run news and mail.  It has not been rebooted.

Am I going crazy?  Has anyone else ever experienced anything like this?
Where might those phantom disk blocks be hiding?  And how could they come
back, as if by magic?

Larry Campbell                     decvax!genrad
The Boston Software Works, Inc.                 \
120 Fulton St.                 seismo!harvard!wjh12!maynard!campbell
Boston MA 02109                         /       /
                                   ihnp4  cbosgd

ARPA: decvax!genrad!wjh12!maynard!campbell at DECWRL.ARPA