[CentOS] What is writing to my filesystem

Dag Wieers dag at centos.org
Thu Apr 9 23:10:16 UTC 2009

On Thu, 9 Apr 2009, JCARRIZOSA at Crutchfield.com wrote:

> I have a CentOS 5.2 box that every few months runs out of drivespace on
> its root filesystem. Last time I manually searched and deleted some big
> files, but don't remember what they were or what wrote to them. The
> applications I'm aware of on the box don't write to /.
> Is there a way to find the files that get written to the most, or grow
> the most over time? Doing a df gives me a snapshot, but it seems clunky
> to keep track of the diff on that output over time. I can then see what
> processes write to them. Any other ideas on how to investigate this are
> welcome.

I like filelight for finding big consumers, unfortunately it requires Qt 
and X.

What is possible as well is to go to your mountpoint that is 
problematic and then use:

   du -xh --max-depth=1

and then follow your gut-feeling in what you think is normal, and what is 
not :)

Doing this on my own laptop just to show, I found out this:

[root at moria var]# du -xh --max-depth=1
554M    ./lib
57M     ./log
16K     ./ftp
942M    ./cache
16K     ./games
24K     ./yp
8.0K    ./nis
508K    ./run
8.0K    ./tux
8.0K    ./cvs
8.0K    ./preserve
12K     ./account
32K     ./empty
1.1M    ./spool
64M     ./clamav
8.0K    ./tmp
8.0K    ./racoon
168K    ./lock
8.6M    ./www
16K     ./mrepo
76K     ./gdm
8.0K    ./local
7.3G    ./crash
140K    ./named
8.0K    ./opt
28K     ./db
8.9G    .

./crash has size 7.3G ??

[root at moria crash]# du -xh --max-depth=1
8.0K    ./2009-02-27-11:59
3.7G    ./2009-04-06-19:37
8.0K    ./2009-01-23-16:56
3.7G    ./2009-04-08-19:55
7.3G    .
[root at moria crash]# ls -l */*
-r-------- 1 root root 4054784396 Apr  6 19:38 2009-04-06-19:37/vmcore
-r-------- 1 root root 4054784396 Apr  8 19:57 2009-04-08-19:55/vmcore

So even when I didn't know anything was wrong, it helped me :)

--   dag wieers,  dag at centos.org,  http://dag.wieers.com/   --
[Any errors in spelling, tact or fact are transmission errors]

More information about the CentOS mailing list