Does your root filesystem df -h sometimes seem a bit more than the sum of it's du -h / parts? My main embedded filesystem has seemed that way for some months, yet when I run my script that checks that lists all the files in the filesystem that did not come out of a package, nothing really showed up as out of place. Yesterday my /etc/fstab was partially corrupted so /proc and /tmp (a tmpfs) did not get mounted. To my surprise ll /tmp showed a bunch of stuff in there from Janurary, that had accidentally gotten created at the root filesystem mountpoint dir /tmp, before the tmpfs was placed there. The pile of 'invisible' (because you can't see it after the tmpfs takes up residence there at the real /tmp) junk amount to ~800KBytes uncompressed, in an 8MB root filesystem that is a very welcome new injection of space. Only yesterday I got a board into a bad place by updating the busybox package, but there was not enough space left to create all the symlinks... these symlinks are all of the shell commands like ln, rm, ls etc.... that required a boot into the serially loaded kernel to repair... I guess that won't be happening so much now I got some space out of my ass.