Root partition

[Madhava Rao Lakkaniki]

Hi all,

Root partition suddenly increased to 8% growth yesterday. How to find out the new files are added in yesterday in root partition for removal.

Thanks,

Rao

[Michael Steele_2]

Dear Rao:

Can you elaborate on '...root partition...'?

a) lvm or vxvm?

b) how are you defining partition? rootdg? vg00? lvol3? / (root) file system?

If file system / (root) then use 'du -k | sort -rn | more'

-or-

# find /dev -type f (* there should only be device files in /dev*)

-or-

# quot / (* list of owners, not very helpful but sometimes useful *)

[Coolmar · Accepted solution]

There are a few things you can do:

1. Print out files that have been modified/added in the past 24 hours
# find / -mtime -1 -print

2. Print all files that are over a certain size - example is 2MB
# find / -size +2000000c

3. I have attached a script that I got on this forum that I use all the time for this sort of thing. It will give you the top 20 directories and the sizes...our root partition went to 100% yesterday and this script showed me right away where the problem was.

[Coolmar]

There are a few things you can do:

1. Print out files that have been modified/added in the past 24 hours
# find / -mtime -1 -print

2. Print all files that are over a certain size - example is 2MB
# find / -size +2000000c

3. I have attached a script that I got on this forum that I use all the time for this sort of thing. It will give you the top 20 directories and the sizes...our root partition went to 100% yesterday and this script showed me right away where the problem was.

usage: # ./top20.sh /directory

[Peter Godron]

Hi Rao,
how about:
#create a temp file with a creation date of 24 hours ago (see man touch)
#touch -mt 200612190000 /tmp/myref
# find /path -xdev -type f -newer /tmp/myref
or
find / -mtime 1

[spex]

Hi Rao,

As has been mentioned many times in the past, UNIX has no notion of creation time of a file. A file's mtime (last modified time) serves as a pseudo-creation time, as long as the file hasn't been modified since it was created.

To make sure you get all of yesterday, and just yesterday, create two reference files and use find's '-newer' primary.

$ touch -t 12190000 /tmp/ref1
$ touch -t 12200000 /tmp/ref2
$ find / -xdev -type f \( -newer /tmp/ref1 -a ! -newer /tmp/ref2)
$ rm /tmp/ref[12]

PCS

[Madhava Rao Lakkaniki]

Thanks for all of you .

I appreciate everyone with promt response. I found the file which has grown (rc.log) too much.

Regards

Rao

[George Liu_4]

Then you probably need to look into the rc.log to seee what caused that

[MarkSyder]

rc.log is usually only updated on reboot. Have you rebooted in the last couple of days? Is the file unusually large? If so, I would look for errors or warnings in it.

Mark Syder (like the drink but spelt different)