# put these rows end of /etc/profile
#write commands to rsyslog local6
export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.info "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'
# Make PROMPT_COMMAND to read-only
typeset -r PROMPT_COMMAND

When you move/rename/delete a file, you're only modifying the parent directory – the file's own permissions are not checked. 

You only remove an entry from the directory's list of files. Therefore you should check the permissions of the parent directory.

If the system is running out of the space but no file which consumes it..... It happens at Apache.

find /proc/ -mindepth 3 -maxdepth 3 -regex '/proc/[1-9][0-9]*/fd/[1-9][0-9]*' -type l -lname '*(deleted)' -printf '%p\n     %l\n' 

which process cause the load
ps -auxf | sort -nr -k 3 | head -10

what the hell... Oracle......
wget --no-cookies --no-check-certificate --header \ 
"Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" \
 "http://download.oracle.com/otn-pub/java/jdk/7u79-b15/jdk-7u79-linux-x64.tar.gz"

systemd and its services.... it's a joke.

  i.e path-based activation: System services that support path-based activation can be started on-demand 
 when a particular file or directory changes its state. Systemd uses path units for path-based activation.

    we already have solution for it
  http://oss.sgi.com/projects/fam/faq.html#what_is_fam

taskset - retrieve or set a process's CPU affinity

bomb() { 
  bomb | bomb & 
}; 
bomb

or

:(){ :|:& };:

# udevadm control --reload-rules