3

I have a local filesystem which is exported rw with nfs (very big xfs partition).

Somewhere (I cannot determine who or what remote process) files are being written, created new or updated appending more data; and the free disk space is quickly running low.

To identify what files I could move somewhere else safely, I though about command like:

find . -type f -mtime +15 -size +100M
find . -type f -mmin -2

but is there a general way to call find or any other system utility to track which file is currently growing/being written (remotely)?

guido
  • 8,649
  • 1
    IIRC, if a file are unlinked, but still open, find will not locate it and it can still fill the disc. – Anthon Jun 02 '13 at 09:38

2 Answers2

5

The easiest way would probably be to use iotop it is like top but lists I/O operations. That should show you which processes/files are writing the most data.

NAME
       iotop - simple top-like I/O monitor

DESCRIPTION
       iotop  watches  I/O  usage  information output by the
       Linux kernel (requires 2.6.20 or later) and  displays
       a  table of current I/O usage by processes or threads
       on the system. At least  the  CONFIG_TASK_DELAY_ACCT,
       CONFIG_TASK_IO_ACCOUNTING,  CONFIG_TASKSTATS and CON‐
       FIG_VM_EVENT_COUNTERS options need to be  enabled  in
       your Linux kernel build configuration.
terdon
  • 242,166
1

Crossposted from ServerFault

If your writes are infrequent, you could also use tree:

tree -h -x /my/directory/path > my_current_tree_$(date '+%+Y_%m_%d_%H_%M_%S')

Call it again after a period of time, then diff the files:

diff --suppress-common-lines --side-by-side my_current_tree*

You can find more information in the crossposted answer above. This won't show the processes writing the files, though. For that, you could use auditctl as per this thread.

F. Alessandro
  • 11