On Thu, 9 Apr 2009, JCARRIZOSA at Crutchfield.com wrote: > I have a CentOS 5.2 box that every few months runs out of drivespace on > its root filesystem. Last time I manually searched and deleted some big > files, but don't remember what they were or what wrote to them. The > applications I'm aware of on the box don't write to /. > > Is there a way to find the files that get written to the most, or grow > the most over time? Doing a df gives me a snapshot, but it seems clunky > to keep track of the diff on that output over time. I can then see what > processes write to them. Any other ideas on how to investigate this are > welcome. I like filelight for finding big consumers, unfortunately it requires Qt and X. What is possible as well is to go to your mountpoint that is problematic and then use: du -xh --max-depth=1 and then follow your gut-feeling in what you think is normal, and what is not :) Doing this on my own laptop just to show, I found out this: ---- [root at moria var]# du -xh --max-depth=1 554M ./lib 57M ./log 16K ./ftp 942M ./cache 16K ./games 24K ./yp 8.0K ./nis 508K ./run 8.0K ./tux 8.0K ./cvs 8.0K ./preserve 12K ./account 32K ./empty 1.1M ./spool 64M ./clamav 8.0K ./tmp 8.0K ./racoon 168K ./lock 8.6M ./www 16K ./mrepo 76K ./gdm 8.0K ./local 7.3G ./crash 140K ./named 8.0K ./opt 28K ./db 8.9G . ---- ./crash has size 7.3G ?? ---- [root at moria crash]# du -xh --max-depth=1 8.0K ./2009-02-27-11:59 3.7G ./2009-04-06-19:37 8.0K ./2009-01-23-16:56 3.7G ./2009-04-08-19:55 7.3G . [root at moria crash]# ls -l */* -r-------- 1 root root 4054784396 Apr 6 19:38 2009-04-06-19:37/vmcore -r-------- 1 root root 4054784396 Apr 8 19:57 2009-04-08-19:55/vmcore ---- So even when I didn't know anything was wrong, it helped me :) -- -- dag wieers, dag at centos.org, http://dag.wieers.com/ -- [Any errors in spelling, tact or fact are transmission errors]