On Thu, 9 Apr 2009, JCARRIZOSA@Crutchfield.com wrote:
I have a CentOS 5.2 box that every few months runs out of drivespace on its root filesystem. Last time I manually searched and deleted some big files, but don't remember what they were or what wrote to them. The applications I'm aware of on the box don't write to /.
Is there a way to find the files that get written to the most, or grow the most over time? Doing a df gives me a snapshot, but it seems clunky to keep track of the diff on that output over time. I can then see what processes write to them. Any other ideas on how to investigate this are welcome.
I like filelight for finding big consumers, unfortunately it requires Qt and X.
What is possible as well is to go to your mountpoint that is problematic and then use:
du -xh --max-depth=1
and then follow your gut-feeling in what you think is normal, and what is not :)
Doing this on my own laptop just to show, I found out this:
---- [root@moria var]# du -xh --max-depth=1 554M ./lib 57M ./log 16K ./ftp 942M ./cache 16K ./games 24K ./yp 8.0K ./nis 508K ./run 8.0K ./tux 8.0K ./cvs 8.0K ./preserve 12K ./account 32K ./empty 1.1M ./spool 64M ./clamav 8.0K ./tmp 8.0K ./racoon 168K ./lock 8.6M ./www 16K ./mrepo 76K ./gdm 8.0K ./local 7.3G ./crash 140K ./named 8.0K ./opt 28K ./db 8.9G . ----
./crash has size 7.3G ??
---- [root@moria crash]# du -xh --max-depth=1 8.0K ./2009-02-27-11:59 3.7G ./2009-04-06-19:37 8.0K ./2009-01-23-16:56 3.7G ./2009-04-08-19:55 7.3G . [root@moria crash]# ls -l */* -r-------- 1 root root 4054784396 Apr 6 19:38 2009-04-06-19:37/vmcore -r-------- 1 root root 4054784396 Apr 8 19:57 2009-04-08-19:55/vmcore ----
So even when I didn't know anything was wrong, it helped me :)