Tony Mountifield wrote: > In article <49DE80CC.4040004 at gmail.com>, > Les Mikesell <lesmikesell at gmail.com> wrote: >> JCARRIZOSA at Crutchfield.com wrote: >>> I have a CentOS 5.2 box that every few months runs out of drivespace on >>> its root filesystem. Last time I manually searched and deleted some big >>> files, but don't remember what they were or what wrote to them. The >>> applications I'm aware of on the box don't write to /. >>> >>> Is there a way to find the files that get written to the most, or grow >>> the most over time? Doing a df gives me a snapshot, but it seems clunky >>> to keep track of the diff on that output over time. I can then see what >>> processes write to them. Any other ideas on how to investigate this are >>> welcome. >> find / -mount -ctime -1 #files that changed today > > ITYM -mtime > In this case it doesn't matter but ctime can never be earlier than mtime and catches some other types of changes like renames, ownership, etc. Ctime is the time of the last change of the inode, and updating mtime would be an inode change. -- Les Mikesell lesmikesell at gmail.com