Troubleshooting SUSE Disk Usage Abnormalities

1. Failure Description

A Linux system experienced abnormal disk usage. The df -h command showed that disk usage was at 100%. Even after rebooting and running df -h again, the disk usage remained at 100%. However, no application was using the deleted data, and checking the disk usage with du -sh / revealed a significant discrepancy between the reported usage and actual disk space. As a result, there was no free space available on the disk for storing data.

2. Troubleshooting

The output of the command showed the following:

After a comparative analysis, it was determined that the system was using the default btrfs file system on SUSE12. The btrfs file system uses a snapshot feature, which periodically creates snapshots of the system or whenever packages are installed via YaST, Zypper, or when kernel patches are applied. These snapshots facilitate system rollbacks.Upon checking the snapshot directory (.snapshots) in the root directory, it was found that the snapshot file was occupying 96 GB of space.

Using the Snapshot Manager commands, it was revealed that multiple snapshots were consuming disk space:

3. Steps Taken

To resolve the issue, the following commands were used to delete the snapshot files:

sqlsnapper delete --sync 155
snapper delete --sync 156
snapper delete --sync 159
snapper delete --sync 160
snapper delete --sync 161
snapper delete --sync 162
snapper delete --sync 163
snapper delete --sync 164
snapper delete --sync 165

After deleting the snapshots, the disk space returned to normal. If this issue occurs again, the same method can be used to free up disk space.

4. Summary

Snapper enables the creation and management of file system snapshots. Snapshots allow a point-in-time copy of the file system to be stored. The default Snapper settings allow for system rollback, though it can also be used to create backups of user data. Snapper works with Btrfs file systems or thin-provisioned LVM volumes using XFS or Ext4 file systems.

5. Snapshot Types

1. Timeline Snapshots:
   Created hourly, with older snapshots automatically deleted. By default, the first snapshot of the last ten days, months, and years is kept. Timeline snapshots are disabled by default.
2. Installation Snapshots:
   Snapshots are created before and after the installation of packages via YaST or Zypper. Important system components, such as the kernel, generate a pair of important snapshots (marked as "important"). Older snapshots are automatically deleted. By default, the last ten important and regular snapshots are kept. Installation snapshots are enabled by default.
3. Management Snapshots:
   These are created when YaST-managed systems are used. Snapshots are taken before and after using a YaST module. Older snapshots are automatically deleted. By default, the last ten important and regular snapshots are kept. Administrative snapshots are enabled by default.