find files modified in last n days

[arkie]

Dear All,

Can someone help me find files that might have been modified in, e.g., the last 4 days ? We can restrict our search to a particular mount point.

The scenario is as such:-

We have a 2-node SG cluster in the production environment. In the node (which is the database server), the $ORACLE_HOME (/oracle/N11/920_64/ or LV /dev/vg04/lvol10) has the problem of frequently getting full and this finally hangs the database and our users can no longer log into SAP. We identified the culprit file to be /oracle/N11/920_64/network/log/listener.log.

We are planning to extend this LV, as it is only 3 GB and the problem is a frequently recurring one (once in a month). But in the meantime we figured out that we can trim the listener.log file (or back it up and touch a new one).

Last time, on May 13 2010, we moved the approx 645 MB log file elsewhere (to /tmp) and touched a new listner.log, rebooted the node - the "space freed" reflected and everything went fine. This time, on June 16 2010, we repeated the same activity, however, we have not taken a node reboot so far. "Space freed" is reflecting in `du -sk` although not in `bdf`. But the new listener.log is not growing this time.

Today, bdf output is showing:-

# bdf /oracle/N11/920_64
Filesystem kbytes used avail %used Mounted on
/dev/vg04/lvol10 3145728 2911000 234120 93% /oracle/N11/920_64

and ...

# du -sk /oracle/N11/920_64
2477552 /oracle/N11/920_64

%used is about 79% used, as we can see. But in the last 4-5 days, %used in bdf has changed from 90% to 93%. Since listener.log is not growing at all, how can we find out where LISTENER is actually writing to?

Can we actually find out files being updated in the last 4-5 days in HP-UX ?

[arkie]

# find . -mtime 4 -type f
./network/log/listener.log
./network/log/.rhosts
./rdbms/audit/ora_15428.aud
./rdbms/audit/ora_17357.aud
./rdbms/audit/ora_21286.aud
./rdbms/audit/ora_29374.aud
./rdbms/audit/ora_29534.aud
./rdbms/audit/ora_29567.aud
./rdbms/audit/ora_2826.aud

Possibly, this is showing files modified in the last 4 days. Although, listener.log is on top of the list, why is then the file still 0 ...

# ll /oracle/N11/920_64/network/log/listener.log
-rw-rw-rw- 1 root sys 0 Jun 16 15:47 ./network/log/listener.log

[Modris Bremze · Accepted solution]

Maybe it is still writing in the file you moved elsewhere (the old .log file) instead of the newly touched one?

To find files modified in the last 4 days (4x24h) use
find . -type f -mtime -4 | xargs ll

[Raj D.]

Arkie,

>Can someone help me find files that might have been modified in, e.g., the last 4 days ?

Suppose todays date is : 06 21 2010 : 900am
To find files created or modified since last 4 days:
1. # touch -t 061720100900 /tmp/ref4days-ago
2. # find / -type f -newer /tmp/ref4days-ago -exec ls -l {} \; > last_4days_files.txt



Enjoy , Have fun!,
Raj.

[singh sanjeev]

why don't you place the /oracle/N11/920_64/network/log/listener.log in diff directory and create a soft link so it won't create trouble for you.


Is permission of listener.log file is OK or KO.??

if log are not generated then you need to restart the listner /or bouncing of DB

[arkie]

Thanks Modris/Raj ... i have the list of files modified in the last 4 days. Interestingly, listener.log (which is 0 bytes) is listed on top. So, the file must have been accessed in some way.

Sanjeev > very great suggestion. thanks. I have created a link under /tmp and also changed the ownership of the target file. Will need to check in the next 24 hrs - else will restart the listener. However,

>> if log are not generated then you need to restart the listner /or bouncing of DB

did not understand the "bouncing of DB" part. Can you pls elaborate.

[DeafFrog]

Dear Sanjeev ,

Bouncing of the DB , for listener log **
In my view just lsnrctl reload or at the max ...lsnrctl sstop/start shuld work .

regards ,

[Dennis Handly]

>"Space freed" is reflecting in "du -sk" although not in bdf. But the new listener.log is not growing this time.

This is a symptom of the process hasn't been restarted (bounced) and is still writing to the old, removed file. find(1) will not find this file and you must use lsof.

>Since listener.log is not growing at all, how can we find out where LISTENER is actually writing to?

You can't, the file was removed but still open.

>Can we actually find out files being updated in the last 4-5 days in HP-UX?

Only the files that weren't removed.

[arkie]

Thank you all Sirs for this nice learning place