LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-10-2009, 01:06 PM   #1
MustangJim
LQ Newbie
 
Registered: Nov 2009
Posts: 4

Rep: Reputation: 0
Root Partition filling at 1MB a minute


First, I'd like to say thank you to the forum as it has been incredibly helpful in my new task of learning and administrating Linux. I am completely new to Linux.

I've been looking for an answer to this with little success, so I thought I'd ask.

Working with Fedora Core 5 in a hosted "No Down Time" web hosting environment. Previous guy was a guru and has removed all Desktop GUI functionality forcing my hand at CLI administration. I have a machine that has started filling the root partition at a rate of close to 1MB a minute. Currently doing everything via root admin (I know, I know) Two things I would like to know:

1. is there a command to identify the file that has been most recently written to disk? Or currently writing to disk for that matter?

2. is there a command to identify the process writing to disk?

3. Am I wrong to assume it is a file being written to disk? Could it be something along the lines of swap/ram drive?

Thanks in advance

MustangJim
 
Old 11-10-2009, 01:14 PM   #2
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Arch
Posts: 8,527

Rep: Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898
Welcome to LQ
I would suggest to start looking at the logfiles.
/var/log/*
 
Old 11-10-2009, 01:21 PM   #3
kilgoretrout
Senior Member
 
Registered: Oct 2003
Posts: 2,474

Rep: Reputation: 189Reputation: 189
You might want to take a look at the fuser command:

http://linux.about.com/library/cmd/blcmdl1_fuser.htm

Also, as suggested above, /var can fill up pretty fast under certain circumstances. In addition, certain malware will flood /tmp to fill up the root partition.
 
Old 11-10-2009, 01:34 PM   #4
GoinEasy9
Member
 
Registered: Feb 2004
Location: Manorville, New York, USA
Distribution: siduction, Fedora 19, openSUSE Tumbleweed
Posts: 379
Blog Entries: 1

Rep: Reputation: 46
Check /var/log/messages, if the file is over 1mb, (actually it shouldn't grow over a couple hundred kilobytes) your problem might be there. A recent problem I had with fedora and the hp printer driver had the message file growing till it filled my root partition.
 
Old 11-10-2009, 01:58 PM   #5
MustangJim
LQ Newbie
 
Registered: Nov 2009
Posts: 4

Original Poster
Rep: Reputation: 0
Var logs and tmp were minimal. I'll look into the fuser and see what that nets.
 
Old 11-10-2009, 02:05 PM   #6
repo
LQ 5k Club
 
Registered: May 2001
Location: Belgium
Distribution: Arch
Posts: 8,527

Rep: Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898Reputation: 898
To find big files:
Code:
find / -size +50M
change +50M to your needs

also try
Code:
cd /
du -sh *
 
Old 11-10-2009, 02:25 PM   #7
MustangJim
LQ Newbie
 
Registered: Nov 2009
Posts: 4

Original Poster
Rep: Reputation: 0
I had seen and used the find and du cmds from previous threads, which helped a little more. I think it's my lack of understanding the CLI syntax for the commands that lead me to ask. Would it be rude to ask "If i wanted to find the last log file written to disk, what is the exact command I would type in at the root level to find it?" If it is, then I didn't ask.
 
Old 11-10-2009, 02:54 PM   #8
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 4,052

Rep: Reputation: 881Reputation: 881Reputation: 881Reputation: 881Reputation: 881Reputation: 881Reputation: 881
Quote:
Originally Posted by MustangJim View Post

Working with Fedora Core 5
is that still supported? OK, that's a separate issue.

Quote:
Previous guy was a guru and has removed all Desktop GUI functionality
Probably never installed it, rather than removed it.

Quote:
Currently doing everything via root admin (I know, I know)
Give me an S, give me a U, give me a D, give me an O. What does that spell? sudo!

Quote:
1. is there a command to identify the file that has been most recently written to disk? Or currently writing to disk for that matter?
If the file is being held open for write, you should be able to find it, along with all other files being held open, with lsof. If it is something like a log being written intermittently, it may be held open only intermittently, so you may need repeated tries. This is easier if not too many files are being held open for other purposes.


Quote:
3. Am I wrong to assume it is a file being written to disk? Could it be something along the lines of swap/ram drive?
It won't be a swap partition; you may be filling up your swap partition but that won't make it seem as if part of the rest of your filesystem is filling up. So, you may run out of swap, but not see what you seem to be seeing.

BTW, what are you seeing; what is the evidence? Is the output of df changing (and posting a df output here would let us see what partitions you have and which of them, if there are several, is actually filling up). I am guessing that your guru is likely to have partitioned the system according to his own tastes and that might be interesting to know, as it might eliminate quite a few things.

This box isn't, by the way a fileserver or mailserver where it might be legitimate for the disk to be filling up at this certain rate, is it? I know this seems to imply that you have to buy a new G worth of storage every 1000 minutes (which is about a terabyte roughly every 2 years, if I have my maths right) but if that's the reality of the situation, that's the reality of the situation.
 
Old 11-10-2009, 02:58 PM   #9
kilgoretrout
Senior Member
 
Registered: Oct 2003
Posts: 2,474

Rep: Reputation: 189Reputation: 189
If you want to find any log file in /var/log that has been changed in the last x minutes you can run as root:

# find /var/log -type f -mmin -x

Or more generally, any file that has been modified or created in / in the last x minutes:

# find / -type f -mmin -x | less

I suggest using the pipe with "less" for doing that command because you will get a ton of output for files in /proc and/or /sys that are constantly changing; they can be ignored for your purposes. You just hit the space bar to page down through the output.

Last edited by kilgoretrout; 11-10-2009 at 03:04 PM.
 
Old 11-10-2009, 03:15 PM   #10
MustangJim
LQ Newbie
 
Registered: Nov 2009
Posts: 4

Original Poster
Rep: Reputation: 0
[root@machine ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 32G 30G 553M 99% /
/dev/sda1 99M 12M 82M 13% /boot
none 1012M 0 1012M 0% /dev/shm
/dev/sdb1 276G 195G 67G 75% /mnt/x
/dev/sdc1 135G 54G 75G 42% /mnt/x

Multiple machines on this network this one hosting websites, others are ftp, db's and backups. I'm new to the environment with only two weeks under my belt. So I'm still trying to decipher how it is all put together because the only person that knew, is now gone. I may have exaggerated a bit, it's roughly a Mb every 3 minutes. So far I've moved over a Gig of no essential tar's and logs since Friday and this is where I am now. Actually 550M after I wrote this. Lucky for me, Nagios is here to help point out the things on fire, this one being the largest...
 
Old 11-10-2009, 07:22 PM   #11
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,240

Rep: Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324
As pointed out above, the 'lsof' and 'fuser' cmds will be useful, also 'find' cmd.
You can get the details here: http://linux.die.net/man/
Incidentally, if its logfiles, the logrotate cmd/service enables you to tell the system to automatically create new logfiles, gzip and/or delete old logfiles. A valuable service.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Delete a file as root- where does it go? My partition is filling up?! linus72 Linux - General 6 07-26-2009 03:21 PM
cannot create 1MB ext2 partition on HDD fitzov Linux - General 5 05-18-2007 06:04 PM
Root partition bizarrely filling up MoghNX01 Linux - Software 4 02-01-2007 03:57 PM
/ partition filling up cgwillis Linux - Newbie 2 04-16-2004 03:31 PM
Filling the root partition causes... Uncreative Slackware 1 05-08-2003 07:46 AM


All times are GMT -5. The time now is 04:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration