Locate fastest growing file

I'm looking at a Solaris 10 system where the application is currently idle, yet i've seen free space on / go from two and a half gigabytes to 112 megabytes in the past 18 hours or so.  How do i detect what file or directory is growing at that rate?
xoxomosAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sentnerCommented:
Sounds like a log out of control.  Run:  du -kx / | sort -n | tail -30
0
sentnerCommented:
Oh, one note:  If you don't have the gnu version of du installed, you'll have to specify the path:
/usr/xpg4/bin/du -kx / | sort -n | tail -30
0
xoxomosAuthor Commented:
This Solaris complains the the x is illegal

oracle@bb4:/u01/app/oracle/admin/BB600/bdump$ du -kx / | sort -n | tail -30
du: illegal option -- x
usage: du [-a] [-d] [-h|-k] [-r] [-o|-s] [-H|-L] [file ...]
0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

sentnerCommented:
Right, that's why I posted the correction. :)  You have to use the xpg4 version.
/usr/xpg4/bin/du -kx / | sort -n | tail -30

If you don't have that installed, you can use it without the -x option, but it won't exclude other filesystems.
0
sentnerCommented:
Another option in case you don't have the xpg version is to use find, and look for files that were modified today over a certain size.  For example, this will find all files over 100MB in the root filesystem (-mount skips other filesystems) modified 0 days ago.
find / -mount -mtime 0 -size +100000000c -ls

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
xoxomosAuthor Commented:
find / -mount -mtime 0 -size +100000000c -ls
Thats what i was looking for ;-)
but i guess something is making tons of smaller files instead since nothing is being found :-(
0
sentnerCommented:
If something is making smaller files, you can reduce the size you're searching for (the "c" on the end of the number stands for characters).  ie, 1MB would be 1000000c.  

Another option you can use if you don't want to include the size, is to search all files modified today (mtime 0), and do a sorted long listing on them:

ls -lrtd `find / -mount -mtime 0 -print` |tail -30
0
xoxomosAuthor Commented:
There must have been something else happening.  The systems person rebooted the machine a few days ago and / has been at a constant 17G free spaces ever since whereas before 2G  free space per day was disappearing.
0
sentnerCommented:
Did you ever find a file or directory that was being modified?  Another possibility is that something was opening files, writing to them, and something was removing the files while they're still open.  If that happens, the filesystem won't release them until the process closes the file handle, or the process is killed.  In that case, a reboot would fix the problem.  Are there any log rotation scripts that were recently put in place?  If not, it could simply have been a rogue process.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Unix OS

From novice to tech pro — start learning today.