find growing files

[arkie]

Hi,

One of the lvols in a production server is 99% full. How can I find the files which have recently grown inside that lvol

thanks in advance

[Jupinder Bedi]

see this doc , it is very helpful for find command with lot of options

http://www.scripterworld.com/2009/07/unix-find-command-with-examples-and.html

[arkie]

Hi Jupinder,

This is a very good link. But I am not getting the appropriate command for this scenario.

I would just like to ask what should be the approach when we find that some lvol of a data VG are getting used unusually fast. In last 3 days the %used has gone to 99% from 98%. If,

find .|xargs ls -l|sort -r -n -k 5,5|head -10

shows the 10 largest files

&&

find . -type f -mtime -3

gives the files that have been modified in tthe last 3 days,

but the results are contradicting:-
1) 10 largest files' timestamps are very old
2) files modified in the last three days are rrather not too big to be significant

[R.K. #]

Hi Sankar,


>>>>
1) 10 largest files' timestamps are very old
2) files modified in the last three days are rrather not too big to be significant
>>>>

Nothing wrong in this. The file modified in last 3 days might not be the largest one. Similarly the file that is the largest one , might not be modified recently.

[R.K. #]

Please tell us more about the logical volume.

What is this LV used for?

# bdf /lv
# du -sk /lv

Is there is any significant difference between above values?

[Dennis Handly]

>but the results are contradicting:

Not contradictory, just unfortunate. If there was some overlap, your job would be done.

If you can't find the growth in 2), you are out of luck for easy solutions.

As RK says, perhaps you have some open unlinked files that are growing? Any big files you have removed lately that were still open?

[arkie]

Hi R.K.,

# bdf /dev/vg04/lvol10
Filesystem kbytes used avail %used Mounted on
/dev/vg04/lvol10 3145728 3116920 28808 99% /oracle/N11/920_64

# cd /oracle/N11/920_64
# du -sk
2475320 .

Yes, looks to have significant difference
3116920 - 2475320

This lvol is used for housing SAP executables

Recently, there was only 1 /oracle/N11/920_64/network/log/listenser.log file, whose older contents were removed to shrink the file size from about 18M to 1.9M at present. This was done by the SAP admins as this activity had helped in the past

But this time, its different

[arkie]

Hi Dennis,

Yes exactly,

(2) is not showing any growth

Recently, there was only 1 /oracle/N11/920_64/network/log/listenser.log file, whose older contents were removed to shrink the file size from about 18M to 1.9M at present. This was done by the SAP admins as this activity had helped in the past

But this time, in the last 3 days usage has gone up to 99% from 98%.

[Dennis Handly]

>looks to have significant difference: 3116920 - 2475320

This is 650 Mb. You'll need to use lsof to find these unlinked files.

>in the last 3 days usage has gone up to 99% from 98%.

This is a trivial 30 Mb.

>whose older contents were removed to shrink the file size from about 18M to 1.9M

How was this "removal" done?

[arkie]

Hi Dennis,

I am halfway stuck here. I have to install the lsof utility and its a production server.

The file that was shrunk earlier was FTP'd to a window m/c, edited, part contents deleted and kept back, as vi was unable to open the file at source.