A mail server writes thousands of tiny files into /var/spool. Deliveries start failing with 'No space left on device', yet `df -h /var/spool` shows the filesystem is only 40% full. Which command confirms the real cause?
LPIC-1 Exam 101-500, objective 104. Devices, Linux filesystems, filesystem hierarchy standard medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct df -i /var/spool
Correct. -i switches df from reporting blocks to reporting inodes, so it shows how many inodes exist, how many are used and how many remain. An ext filesystem full of tiny files runs out of inodes long before it runs out of blocks.
Not correct df -T /var/spool
Wrong. -T adds a column naming the filesystem type. Useful for deciding whether to reach for e2fsck or xfs_repair, but it says nothing about exhaustion.
Not correct du -h --max-depth=1 /var/spool
Wrong. du adds up the space the files occupy. Millions of small files consume very little space, so this output looks entirely healthy while the filesystem is unusable.
Not correct lsblk -f
Wrong. lsblk -f lists block devices with their filesystem type, label, UUID and mount point, and on recent util-linux versions a block-based free-space column as well. It never reports inode counts, so it cannot show that the inode table is what is full.
Why
A filesystem has two independent budgets: data blocks and inodes, one inode per file or directory. When either runs out, writes fail with ENOSPC, so 'No space left on device' with free blocks almost always means the inode table is full. df -h reports blocks and df -i reports inodes. On ext2/3/4 the inode count is fixed when mke2fs runs (tuned with -N or -i) and cannot be raised later without recreating the filesystem; XFS allocates inodes dynamically and so rarely hits this wall.
Where this comes from
- Cited
- manual page df(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 104 and space the ones you get wrong.
More questions on this objective
- A new disk /dev/sdb has no partition table at all. Which command writes an empty GPT partition table onto it without dropping you into an interactive editor? machine-checked
- You need the partition /dev/sdc1 on a USB stick to carry a FAT32 filesystem so that Windows machines can read and write it. Which command creates it? machine-checked
- You have just run `mkswap /dev/sdb2`. Which command makes the kernel start using that swap area immediately, without a reboot? machine-checked
- Why is it dangerous to run e2fsck against an ext4 filesystem that is currently mounted read-write? machine-checked
- On an ext4 filesystem at /dev/sda1 you want an automatic check to be forced after every 30 mounts. Which command sets that? machine-checked
- `df -h /var` reports the filesystem 100% full, but `du -sh /var` accounts for only about half that space. Nothing is hidden under a mount point. What is the most likely explanation? machine-checked
All questions on Devices, Linux filesystems, filesystem hierarchy standard