disk space?
 

I had this come up in logwatch:
/dev/sda5 4.8G 3.6G 960M 80% /


any ideas how I can find which files are suddenly taking up the space?

cd / && du -mx | sort -rn | head -n 50

That will print the 50 largest files on your / partition.

The problem is that it is increasing day by day by a few percent and I'm not sure what it is?
I installed a running program on wine recently so I suspect it's an exe that produces log files that are filling up but no real way of knowing:

Well, you do seem to have rather a big wine folder under /root (about 1.2GB). Considering the posted output, it's the only thing that would account for the filesize growing by a few percents every day.

You can run du -xa | sort -rn on /root/.wine-1.2 to get the details. If you do that over the next hours or days, you should be able to figure out what it is that is growing all the time.

Try this:

find / -size +100000 -type f

Seems like a load of dlls, they shouldn't really be causing an issue should they?
Perhaps /programs?


This comes up with a core file, which is strange...

I have just run this again after the drive increased 2% but none of the values seem to be different:
Any ideas on what else to try?

[root wine-1.2]# find / -size +100000 -type f
/home/jasonnxs/core.29206
/usr/lib/locale/locale-archive

[root wine-1.2]# cd /home/jasonnxs
[root jasonnxs]# ls
core.29206 Desktop Fonts Maildir
[root jasonnxs]# ls -l
total 43492
-rw------- 1 jasonnxs jasonnxs 52985856 Jul 22 13:24 core.29206

You can do a To find all files modified in the last 24 hours. You can change the / to a specific path if you want to narrow the search

du --max-depth=1 /
du --max-depth=1 /suspect_path/
du --max-depth=1 /further/suspect_path/

In all likelihood, check /home/ first, then /var/log/, then worry more about the global picture.

Some growth is expected on a new system until your cache's are filled. i.e. if you allocated a 1GB cache to mozilla. Email is another one the slowly adds up if you don't delete. Thumbnails on an image viewer. Various log files and stuff like that.

It could also be something weird like hosing /dev/null with a file and not a device. So instead of going to oblivion, it's appending to a file. Less likely with udev and stuff at the helm, but possible.

It could also be /tmp/ contents not being cleared like they should when done. i.e. if audacity crashes and stuff like that. Rebooting should clear that. And other quirks like stripping down /var/log/ stuff and not restarting /etc/init.d/rsyslog (or whatever variant you have handling that).

4GB for a system is kind of tiny for modern uses. I edit audio files bigger than that. Especially with audacity making a copy of your last version in /tmp/ everytime you do an edit. Which prompted me to boost / to 40GB. The router is in that 4GB neck of the woods. But for a modern desktop system, especially if you're into media elements like recording. Your swap is probably bigger than that.

The HD is about 250GB, I think this is just one portion of it. Perhaps I installed wine onto the wrong partition.
It can't be a problem with /var as that's on the /dev/sda3 partition.
I can only think it's /root or /home
I'll run these again in a few hours and see if the amounts vary:

It looks like /tmp falls into / which is on that partition. Java applets and other garbage can linger there depending on your version-ing / stability of things.

It shouldn't really be /root/ as that's basically home for root. Unless root is always logged in and doing stuff (which it shouldn't be). But not out of the realm of possibility for newbies, or compromised systems.

I've had odd versions of things that did stuff BITD. mplayer and other quirks polluting ~/.xsession-errors to a sizable girth. What exactly are you running wine on anyway? Baring a few games, most every function has a native linux app that performs those tasks. Maybe not as full featured as some apps. But email, web browsing, office documents, and other things. Even audio and video editing. Midi synthesis, 3D rendering, and other things.

/usr/share/doc/ can be quite the hog, but not normally one to expand after installation. Otherwise /tmp/ and /home/ are the only ones that could / should expand at the user level. You can administratively set per user limits, but that'll likely do little more than break your system, or keep you from doing what you want to be doing. You could put /home/ on it's own partition. But that doesn't solve your immediate problem.

$ du -h --max-depth=1 /tmp/
$ du -h --max-depth=1 /home/

# du -h --max-depth=1 /root/

2% of 4GB is roughly 80MB, which is sizable growth, but nothing compared to HD video and other media types. Roughly 8 minutes of a youtube video. Probably less than 2 minutes of a video DVD. 8-ish minutes of an audio CD. Kernel sources are in the 40MB size range. Uncompressed and compiled in that 400MB size range.

If you have space on another device to make a copy of your system as it is now, or at least part of it. Which you should do for backups anyway. You could take a snapshot now. Take one after a period of time and diff the two. It should give you a good feel for WHAT changed. Then you can dive deeper and figure out by how much, why, where, what's doing it, and stuff. Once you have the two snapshots, you can run the diff on some other machine and keep that one up and doing whatever. lsof and other tools to identify what or who is touching what.

You could also try a program called KDirStat to get a visual representation of all this data.

Still monitoring this, the disk size seems to have stopped increasing at 81%, which is strange but will check next week.
Can I create a mount point for /home and move it to the /dev/sda2 drive?
Would I have to restart after doing this?

[root /]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda5 4956284 3785144 915308 81% /
/dev/sda3 4956316 2929420 1771064 63% /var
/dev/sda1 77749 23626 50109 33% /boot
tmpfs 475204 0 475204 0% /dev/shm
/dev/sda2 233345000 36010044 197334956 16% /var/spool/squid
[root /]#

Yes, you could do that quite easily. But even if you did, you'd still have a / partition that is 80% full as your home folder appears to be rather small. Add more packages and you may see fragmentation kicking in.
Not to mention that we still don't know whether it is really /home that is causing your issue. The best approach would be not only to move your home partition to a partition of its own but to grow your / filesystem.