How do I get the last 10 files that were modified on my system. I have a system where its disk usage is maxed out I am not sure which files is increasing rapidly.
I have a mysql instance stored on a separate mounted device and I just created a softlink unto my /var/lib directory on my root device. I know symlinks does not affect disk usage.
You can use find, stat, sort, and tail to do that.
find . -exec stat --format="%X" + | sort -n | tail -n 10
However, you might consider using watch and du. watch will run a command periodically (every 2sec by default). And du shows disk usage. This command will show you the disk usage of every file and folder in the current directory, and the output will continuously be refreshed.
watch "du -s *"
You can start at root and see which folder is increasing the quickest, then progress down the folder hierarchy until you find the culprit(s).
If you're in a folder that has too many files to see on the screen at once, you can limit it by segregating the files like du -s [a-h]*. Also, this won't show hidden files; for that you need .* or .[a-h]*, etc.
You could put together a find+sort+... etc. command to do what you ask quite literally. But to achieve the goal of finding the top-disk-usage program, better use iotop.
You may want to try live monitoring with either LoggedFS or Linux's audit subsystem (or your unix variant's equivalent feature). See this answer for more information. Note that if a lot of programs use this filesystem, this will produce a lot of logs. Make sure that you aren't logging to the watched filesystem. With the audit subsystem, this rule should do the trick.
auditctl -a exit,always -F dir=/mount/point -S write
