No space left on device (28)?

[DeathMarine]

i have 4 sites running on my server yet only one give me this error.

Warning: session_start() [function.session-start]: open(/tmp/sess_8c2fc218a7cc2629b183afa94f414541, O_RDWR) failed: No space left on device (28) in /home/dmcom/public_html/index.php on line 114

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/dmcom/public_html/index.php:114) in /home/dmcom/public_html/index.php on line 114

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/dmcom/public_html/index.php:114) in /home/dmcom/public_html/index.php on line 114

it started today and its been running fine for at least a month. i checked my hdd space from root and got this:

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
471016352 52272404 394431732 12% /
/dev/sda1 101086 16844 79023 18% /boot
tmpfs 1033724 0 1033724 0% /dev/shm
/usr/tmpDSK 495844 302971 167273 65% /tmp

it seems i have enough space. the site is set to use "unlimited" space.

any advice fixing this problem would be GREATLY appreciated!

[jasonaward]

Have you tried clearing out the /tmp directory? It's possible that you've hit your max number of inodes, files per directory, or some other limit.

[ChronoCross]

Does it do it constantly? or randomly? That error seems like you might not have read/write access to that directory from the account.

[DeathMarine]

i think i was hacked. because now i get these in my email:

Attempts to create new directories or files whose filenames begin with numbers have failed.
This is indicative of a root compromise of the server.

The exact error encountered was:

Failed to create directory /tmp/cpanel.TMP.POYxGC1onK3fbI0p: No space left on device

im running the trojan scanner that comes with WHM but when i do it just seems to get stuck. how long does it take to complete a trojan scan?

btw, i really do appreciate how you guys always help out :)

EDIT: about the /tmp folder. i log in and there is a tmp/ folder. then i go up 1 directory ( where root/ urs/ var/ are) and there is another /tmp folder which has this:
aquota.user* eaccelerator/ lost+found/ mysql.sock@

i'm too afraid to just rm -rf that folder unless i get an ok from you guys.