[CentOS] What is writing to my filesystem

Fri Apr 10 15:58:09 UTC 2009
Les Mikesell <lesmikesell at gmail.com>

Tony Mountifield wrote:
> In article <49DE80CC.4040004 at gmail.com>,
> Les Mikesell <lesmikesell at gmail.com> wrote:
>> JCARRIZOSA at Crutchfield.com wrote:
>>> I have a CentOS 5.2 box that every few months runs out of drivespace on
>>> its root filesystem. Last time I manually searched and deleted some big
>>> files, but don't remember what they were or what wrote to them. The
>>> applications I'm aware of on the box don't write to /. 
>>> Is there a way to find the files that get written to the most, or grow
>>> the most over time? Doing a df gives me a snapshot, but it seems clunky
>>> to keep track of the diff on that output over time. I can then see what
>>> processes write to them. Any other ideas on how to investigate this are
>>> welcome.
>> find / -mount -ctime -1  #files that changed today
> ITYM -mtime

In this case it doesn't matter but ctime can never be earlier than mtime 
and catches some other types of changes like renames, ownership, etc. 
Ctime is the time of the last change of the inode, and updating mtime 
would be an inode change.

   Les Mikesell
    lesmikesell at gmail.com