how can i find the file that it increased most quickly?

[常有慈悲心]

thanks

[Steven E. Protter · Accepted solution]

To do this, you have to take snaphots, or collect some kind of data over time.

Here is a simple way.


filename=$(date)
cd /
du -k | sort -rn > /tmp/$filename

Have cron run it once a day.

Then you can compare the data between the two files and figure out which one had the most growth.

I don't have time to script that right now, but if you look at the output you'll get the idea.

SEP

[Hein van den Heuvel]

You might want to reduce the number of files to monitor by setting a lower threshold of say 2.5MB, suggesting that any growth below that level is not too interesting.

So that would mean something like (untested)

filename=$(date)
find / -size +5000 -exec du -k {} \; | sort -k 2 > /xxx/$filename.xxx
:
diff...

Hein.

[Sridhar Bhaskarla]

Hi,

I would rely on the size and a recent time stamp of it. For ex., if you are seeing it increased in the last 5 minutes, then find all the files that are above 10 MB but modified within last 5 mins. To do that, touch a file with a time stamp less than five minutes ago and then use it as a reference with -newer option.

touch 1019103004 /tmp/stamp
find /directory -newer /tmp/stamp -size 10000000c

-Sri

[Hein van den Heuvel]

Yes, excellent plan to not only take the size into account, but also the modification time. If it is a small file, it is not intesting. If it is a large files, but has not changed for days/weeks (like the Oracle executable), then it is not interesting either. The whole point being to weed out the bulk of the data and focus on real candidates with minimal effort.

Hein.

[Muthukumar_5]

We can use ls with -s option to get file size there. IF you want to collect only files then,

find / -type f -exec ls -s {} \; > /tmp/sizereport_$(date +'%b_%e_%H')

do cron this, so that you will get reports based on the cron execution time.

It will give format of file informations as,

size filename.

Log file represents /tmp/sizereport_Month_date_hour

HTH.