filesystem full

[Unix Administrator_6]

/ is 100% full on a development box.
Its usually at 20% consistently. How can I tell what files have changed since yesterday only?

[John Palmer]

touch -t 0008160000 /tmp/xx
find / -xdev -newerm /tmp/xx -exec ll -d {} \;

See man touch and man find for details.

[James R. Ferguson]

Sheri:

Look for core dumps, particularly in /dev.

Do: find / -mtime 1 -exec ls -l {}\;
or: find / -mtime +1 -exec ls -l {}\;

...JRF...

[Stefan Farrelly]

ls -lR | grep"Aug 16"

[Tim Malnati]

Use the du command to locate the general area where data was added and a further find command with the size option to locate specific files after that.

I have found two particular problems that tend to corrupt things in this way.

1. Someone processes some form of backup function to a device that does not exist. A new device file is created as a result and explodes quickly.

2. Someone creates a new directory under the root file system and populates it. It's not an unusual case that some vendors install process may be the culprit. It expects an adequate file system to be there for the application and the install was invoked before the new file system was created.

[Unix Administrator_6]

In John Palmers message, what am I supposed to put in the "xx"?
and
is it supposed to be -newer or -newerm?

[Anthony deRito · Accepted solution]

list files sorted by time:
#ls -lt

find files [n] days old:
#find / -mtime +[n] -exec ll {} ;

find large files [n] size:
#find / -xdev -size +$[n]c -exec ll {} ;

find large disk usage directories:
#du -x | sort -n

Tony

[Cheryl Griffin]

I find the command that Stefan offers provides better results than using find with mtime since the mtime of so many system files are modified on a daily basis.

On a test system the find command returned close to 2000 files, whereas the ls-grep command returned only 30. That's a big difference to sort through.

[Cheryl Griffin]

-newerm shows The time the file was last modified

[John Palmer]

Sheri,

touch is just creating a temporary file with the specified date and time last written.

Then you use the -newerm flag of find to select files modified since that date.

This technique allows you to set a precise time to search against rather than -mtime which is a number of days.

/tmp/xx was an example of any old file. You ought to ensure that it doesn't exist first and remember to remove it after.

The -xdev option to find was to stop it traversing any mount points as you said that the problem was in /.

Regards,
John