"mount: / is busy" when trying to mount as read-only so that I can run zerofree

Some processes are keeping files open for writing. These could be, for example, programs that write logs, like rsyslogd, networking tools, like dhclientor something else. Shutting these down one by one and trying the remount might work.

You can find processes that use certain files by using the program fuser. For example, fuser -v -m / will return a list of processes. However, I am not sure if it is one of these which keeps the file system busy.

You can only remount the filesystem read-only if there is no process that has a file open for writing. Run lsof / to see what processes have files open on the root filesystem. Files open for writing will be indicated in the FD column. You can filter these with

lsof / | awk '$4 ~ /[0-9].*w/'

To filter the process IDs automatically, parse the output of lsof -F pa:

lsof -F pa /home | awk '/^p/ {pid = substr($0, 2)} /^a.*w/ {print pid}'

Improving Peter answer:

I could not kill processes that uses my mount point. So, I did this:

• Edit /etc/fstab to starts in read-only in next boot. Ex: /dev/sda1 / ext2 ro 0 1
• Reboot and open a shell (Host Key + F2, for instance)
• Run zerofree

To "recover" your system:

• Mount with read-write option: $ mount -o remount,rw /dev/sda1
• Edit /etc/fstab again, restoring your original value

Extra: if necessary open recovery mode in any step:

• Reboot
• Hold shift while VM is loading
• Advanced Options > Kernel option with Recovery Mode > Drop to Root Shell Prompt