How to locate small file consumption creep

[Lisa Kachold]

find / -atime +1 # fild all files starting at / accessed 1 day ago.
find / -atime +1 </tmp/fileage # put list of files starting at / into a tmp file called fileage
find . -atime +1 -type f -exec mv {} TMP \; # mv files accessed (in . dirspec) from 1 day to dir TMP

Note differences between atime, ctime and mtime:

"-atime/-ctime/-mtime" 
	[+|-]n

	Specify selection of the files based on  three 
	Unix timestamps: the last time 
	a files's "access time", "file status" and "modification time".    
	

	n  is time 
	interval -- an integer with optional sign. It is measured in 
	24-hour periods (days) or minutes counted from the current moment.n: If the integer n does not have 
		sign this means exactly n 24-hour periods (days) ago, 0 means 
		today. 

		+n: if it has plus sing, then it 
		means "more then n 24-hour periods (days) ago", or older then n,

		-n: if it has the minus sign, then 
		it means less than n 24-hour periods (days) ago (-n), or younger then 
		n. It's evident that -1,  and 0 are the same and both means "today".
		
http://www.wagoneers.com/UNIX/FIND/find-usage.html

www.Obnosis.com |  http://en.wiktionary.org/wiki/Citations:obnosis |  hackfest.obnosis.com (503)754-4452
January PLUG HackFest = Kristy Westphal, AZ Department of Economic Security Forensics @ UAT 1/10/09 12-3PM
Take the Black [Linux BT3] Pill & leave SecurityMatrix, or take the Blue [XP/Vista Pill] & stay happily ignorant.


> Date: Wed, 24 Dec 2008 08:56:56 -0700
> From: waydavis at cox.net
> To: plug-discuss at lists.plug.phoenix.az.us
> Subject: Re: How to locate small file consumption creep
> 
> Most likely a hidden file or files. Since it is in HOME
> 
> I run Kubuntu. (I) would use Krusader to compare directories, BUT I'll 
> bet there is someone here with a simple command line that will do the 
> trick. :-)
> 
> 
> Josef Lowder wrote:
> > How can I locate what seems to be a small file consumption
> > "creep" on my system.  In one 10-gig partition, I have about 1.1 gig
> > of free space available, but I've noticed that some of this space
> > seems to go away overnight when nothing is running.
> >
> > For example, last night 'df' showed this:
> > Filesystem            Size  Used Avail Use% Mounted on
> > /dev/hda2             9.9G  2.7G  6.7G  29% /
> > /dev/hda1              76M  5.3M   67M   8% /boot
> > /dev/hda3             9.9G  8.8G  1.1G  90% /home
> > /dev/hda7             9.9G  7.3G  2.1G  78% /mnt/hda7
> >
> > And this morning, 'df' showed this:
> > Filesystem            Size  Used Avail Use% Mounted on
> > /dev/hda2             9.9G  2.7G  6.7G  29% /
> > /dev/hda1              76M  5.3M   67M   8% /boot
> > /dev/hda3             9.9G  9.0G  951M  91% /home
> > /dev/hda7             9.9G  7.3G  2.1G  78% /mnt/hda7
> >
> > So what could account for the loss of file space from
> > 1.1G to 951M overnight with nothing running
> > and how could I search my system to find an answer?
> > ---------------------------------------------------
> > PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> > To subscribe, unsubscribe, or to change your mail settings:
> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> >
> >   
> 
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss

_________________________________________________________________
It’s the same Hotmail®. If by “same” you mean up to 70% faster.
http://windowslive.com/online/hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_broad1_122008
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20081224/d9798da7/attachment.htm