disk space?

qwertyjjj · 07-27-2010, 06:11 PM

I had this come up in logwatch:
/dev/sda5 4.8G 3.6G 960M 80% /

any ideas how I can find which files are suddenly taking up the space?

jay73 · 07-27-2010, 06:16 PM

cd / && du -mx | sort -rn | head -n 50

That will print the 50 largest files on your / partition.

qwertyjjj · 07-27-2010, 06:21 PM

Quote:

Originally Posted by jay73

cd / && du -mx | sort -rn | head -n 50

That will print the 50 largest files on your / partition.

The problem is that it is increasing day by day by a few percent and I'm not sure what it is?
I installed a running program on wine recently so I suspect it's an exe that produces log files that are filling up but no real way of knowing:

Code:

[root /]# cd / && du -mx | sort -rn | head -n 50
3387    .
1930    ./usr
991     ./usr/share
679     ./root
652     ./root/wine-1.2
583     ./usr/lib
467     ./root/wine-1.2/dlls
283     ./usr/share/locale
250     ./home
179     ./usr/local
172     ./lib
172     ./home/jasonnxs
163     ./tmp
153     ./usr/local/lib
151     ./usr/local/lib/wine
147     ./etc
146     ./lib/modules
144     ./usr/share/doc
123     ./root/wine-1.2/programs
121     ./usr/lib/locale
104     ./usr/lib/wine
104     ./usr/bin
95      ./home/jasonnxs/.wine/drive_c
95      ./home/jasonnxs/.wine
87      ./root/wine-1.2/programs/winetest
79      ./home/jason
77      ./etc/selinux/targeted
77      ./etc/selinux
76      ./home/jason/.wine
76      ./home/jasonnxs/.wine/drive_c/windows
75      ./home/jason/.wine/drive_c
75      ./etc/selinux/targeted/modules
63      ./usr/share/icons
61      ./home/jason/.wine/drive_c/windows
58      ./usr/lib/python2.4
53      ./lib/modules/2.6.18-194.8.1.el5.centos.plus
53      ./etc/gconf
52      ./lib/modules/2.6.18-194.8.1.el5.centos.plus/kernel
48      ./lib/modules/2.6.18-194.8.1.el5
46      ./lib/modules/2.6.18-194.8.1.el5/kernel
45      ./usr/share/gnome
44      ./usr/share/man
44      ./usr/share/gnome/help
44      ./lib/modules/2.6.18-164.11.1.el5
43      ./usr/share/foomatic/db/source
43      ./usr/share/foomatic/db
43      ./usr/share/foomatic
43      ./lib/modules/2.6.18-164.11.1.el5/kernel
42      ./home/jasonnxs/.wine/drive_c/windows/system32
38      ./usr/share/festival

jay73 · 07-27-2010, 06:43 PM

Well, you do seem to have rather a big wine folder under /root (about 1.2GB). Considering the posted output, it's the only thing that would account for the filesize growing by a few percents every day.

You can run du -xa | sort -rn on /root/.wine-1.2 to get the details. If you do that over the next hours or days, you should be able to figure out what it is that is growing all the time.

AwesomeMachine · 07-27-2010, 08:06 PM

Try this:

find / -size +100000 -type f

qwertyjjj · 07-27-2010, 09:42 PM

Quote:

Originally Posted by jay73

Well, you do seem to have rather a big wine folder under /root (about 1.2GB). Considering the posted output, it's the only thing that would account for the filesize growing by a few percents every day.

You can run du -xa | sort -rn on /root/.wine-1.2 to get the details. If you do that over the next hours or days, you should be able to figure out what it is that is growing all the time.

Seems like a load of dlls, they shouldn't really be causing an issue should they?
Perhaps /programs?

Code:

[root wine-1.2]# du -xa | sort -rn | less
667068  .
477844  ./dlls
125588  ./programs
88168   ./programs/winetest
30004   ./dlls/mshtml
21668   ./programs/winetest/winetest.exe.so
21492   ./programs/winetest/winetest.exe.fake
18496   ./include
17692   ./dlls/wined3d
16748   ./dlls/user32
16688   ./dlls/kernel32
15568   ./dlls/msi
15412   ./dlls/oleaut32
15124   ./dlls/ole32
14020   ./dlls/shell32
11240   ./dlls/ntdll
11092   ./dlls/comctl32
10300   ./libs
10276   ./server
10016   ./tools
9200    ./libs/wine
9048    ./dlls/mshtml/mshtml.dll.so
9000    ./dlls/quartz
8980    ./documentation
8920    ./dlls/crypt32
8456    ./dlls/actxprxy
8344    ./dlls/ddraw
7796    ./dlls/d3d9
7276    ./dlls/gdi32
6928    ./dlls/msi/tests
6496    ./dlls/rpcrt4
6424    ./dlls/winex11.drv
6016    ./dlls/user32/tests
5832    ./dlls/urlmon
5544    ./dlls/jscript
5180    ./dlls/wined3d/wined3d.dll.so
5148    ./dlls/kernel32/tests
4980    ./dlls/riched20
4932    ./dlls/krnl386.exe16
4808    ./dlls/opengl32
4804    ./dlls/oleaut32/tests
4764    ./dlls/advapi32
4760    ./dlls/comdlg32
4728    ./dlls/d3d8
4704    ./dlls/d3dx9_36
4564    ./documentation/ChangeLog.ALPHA
4560    ./dlls/msvcrt
4452    ./programs/winecfg
4432    ./dlls/gdiplus
:

Quote:

Originally Posted by AwesomeMachine

Try this:

find / -size +100000 -type f

This comes up with a core file, which is strange...

Code:

[root wine-1.2]# find / -size +100000 -type f
/home/jasonnxs/core.29206
/usr/lib/locale/locale-archive
/tmp/sarg-file.in
/proc/kcore
find: /proc/29098/task/29098/fd/4: No such file or directory
find: /proc/29098/fd/4: No such file or directory

qwertyjjj · 07-29-2010, 01:25 PM

I have just run this again after the drive increased 2% but none of the values seem to be different:
Any ideas on what else to try?

Code:

667068  .
477844  ./dlls
125588  ./programs
88168   ./programs/winetest
30004   ./dlls/mshtml
21668   ./programs/winetest/winetest.exe.so
21492   ./programs/winetest/winetest.exe.fake
18496   ./include
17692   ./dlls/wined3d
16748   ./dlls/user32
16688   ./dlls/kernel32
15568   ./dlls/msi
15412   ./dlls/oleaut32
15124   ./dlls/ole32
14020   ./dlls/shell32
11240   ./dlls/ntdll
11092   ./dlls/comctl32
10300   ./libs
10276   ./server
10016   ./tools
9200    ./libs/wine
9048    ./dlls/mshtml/mshtml.dll.so
9000    ./dlls/quartz
8980    ./documentation
8920    ./dlls/crypt32
8456    ./dlls/actxprxy
8344    ./dlls/ddraw
7796    ./dlls/d3d9
7276    ./dlls/gdi32
6928    ./dlls/msi/tests
6496    ./dlls/rpcrt4
6424    ./dlls/winex11.drv
6016    ./dlls/user32/tests
5832    ./dlls/urlmon
5544    ./dlls/jscript
5180    ./dlls/wined3d/wined3d.dll.so
5148    ./dlls/kernel32/tests
4980    ./dlls/riched20
4932    ./dlls/krnl386.exe16
4808    ./dlls/opengl32
4804    ./dlls/oleaut32/tests
4764    ./dlls/advapi32
4760    ./dlls/comdlg32
4728    ./dlls/d3d8
4704    ./dlls/d3dx9_36
4564    ./documentation/ChangeLog.ALPHA
4560    ./dlls/msvcrt
4452    ./programs/winecfg
4432    ./dlls/gdiplus

[root wine-1.2]# find / -size +100000 -type f
/home/jasonnxs/core.29206
/usr/lib/locale/locale-archive

[root wine-1.2]# cd /home/jasonnxs
[root jasonnxs]# ls
core.29206 Desktop Fonts Maildir
[root jasonnxs]# ls -l
total 43492
-rw------- 1 jasonnxs jasonnxs 52985856 Jul 22 13:24 core.29206

ncsuapex · 07-29-2010, 01:34 PM

You can do a

Quote:

find / -mtime -1 -type f -exec ls -lh {} \;

To find all files modified in the last 24 hours. You can change the / to a specific path if you want to narrow the search

Shadow_7 · 07-29-2010, 01:57 PM

du --max-depth=1 /
du --max-depth=1 /suspect_path/
du --max-depth=1 /further/suspect_path/

In all likelihood, check /home/ first, then /var/log/, then worry more about the global picture.

Some growth is expected on a new system until your cache's are filled. i.e. if you allocated a 1GB cache to mozilla. Email is another one the slowly adds up if you don't delete. Thumbnails on an image viewer. Various log files and stuff like that.

It could also be something weird like hosing /dev/null with a file and not a device. So instead of going to oblivion, it's appending to a file. Less likely with udev and stuff at the helm, but possible.

Shadow_7 · 07-29-2010, 02:04 PM

It could also be /tmp/ contents not being cleared like they should when done. i.e. if audacity crashes and stuff like that. Rebooting should clear that. And other quirks like stripping down /var/log/ stuff and not restarting /etc/init.d/rsyslog (or whatever variant you have handling that).

4GB for a system is kind of tiny for modern uses. I edit audio files bigger than that. Especially with audacity making a copy of your last version in /tmp/ everytime you do an edit. Which prompted me to boost / to 40GB. The router is in that 4GB neck of the woods. But for a modern desktop system, especially if you're into media elements like recording. Your swap is probably bigger than that.

qwertyjjj · 07-29-2010, 05:01 PM

Quote:

Originally Posted by Shadow_7

It could also be /tmp/ contents not being cleared like they should when done. i.e. if audacity crashes and stuff like that. Rebooting should clear that. And other quirks like stripping down /var/log/ stuff and not restarting /etc/init.d/rsyslog (or whatever variant you have handling that).

4GB for a system is kind of tiny for modern uses. I edit audio files bigger than that. Especially with audacity making a copy of your last version in /tmp/ everytime you do an edit. Which prompted me to boost / to 40GB. The router is in that 4GB neck of the woods. But for a modern desktop system, especially if you're into media elements like recording. Your swap is probably bigger than that.

The HD is about 250GB, I think this is just one portion of it. Perhaps I installed wine onto the wrong partition.
It can't be a problem with /var as that's on the /dev/sda3 partition.
I can only think it's /root or /home

Code:

[root ~]# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda5              4956284   3765952    934500  81% /
/dev/sda3              4956316   2801532   1898952  60% /var
/dev/sda1                77749     23626     50109  33% /boot
tmpfs                   475204         0    475204   0% /dev/shm
/dev/sda2            233345000  36012756 197332244  16% /var/spool/squid
[root ~]#

I'll run these again in a few hours and see if the amounts vary:

Code:

[root ~]# du --max-depth=1 /home/
68      /home/default
80216   /home/jason
167044  /home/jasonnxs
247336  /home/

[root ~]# du --max-depth=1 /root/
36      /root/.gnome2
4       /root/.gnome2_private
28      /root/.metacity
84      /root/.gconf
667068  /root/wine-1.2
8       /root/.oprofile
192     /root/.gstreamer-0.10
4       /root/.Trash
4       /root/.gconfd
12      /root/.nautilus
12      /root/.gnome
8       /root/.redhat
8960    /root/flex-2.5.35
4       /root/.eggcups
694920  /root/

[root ~]# du --max-depth=1 /var/log
24      /var/log/gdm
654572  /var/log/squid
648     /var/log/httpd
40      /var/log/cups
8       /var/log/pm
44      /var/log/prelink
2392    /var/log/rkhunter
8       /var/log/ppp
68      /var/log/matrixsa
8       /var/log/conman
5540    /var/log/sa
17320   /var/log/audit
8       /var/log/conman.old
4       /var/log/iptraf
685788  /var/log
[root ~]#

Shadow_7 · 07-30-2010, 04:49 AM

It looks like /tmp falls into / which is on that partition. Java applets and other garbage can linger there depending on your version-ing / stability of things.

It shouldn't really be /root/ as that's basically home for root. Unless root is always logged in and doing stuff (which it shouldn't be). But not out of the realm of possibility for newbies, or compromised systems.

I've had odd versions of things that did stuff BITD. mplayer and other quirks polluting ~/.xsession-errors to a sizable girth. What exactly are you running wine on anyway? Baring a few games, most every function has a native linux app that performs those tasks. Maybe not as full featured as some apps. But email, web browsing, office documents, and other things. Even audio and video editing. Midi synthesis, 3D rendering, and other things.

/usr/share/doc/ can be quite the hog, but not normally one to expand after installation. Otherwise /tmp/ and /home/ are the only ones that could / should expand at the user level. You can administratively set per user limits, but that'll likely do little more than break your system, or keep you from doing what you want to be doing. You could put /home/ on it's own partition. But that doesn't solve your immediate problem.

$ du -h --max-depth=1 /tmp/
$ du -h --max-depth=1 /home/

# du -h --max-depth=1 /root/

2% of 4GB is roughly 80MB, which is sizable growth, but nothing compared to HD video and other media types. Roughly 8 minutes of a youtube video. Probably less than 2 minutes of a video DVD. 8-ish minutes of an audio CD. Kernel sources are in the 40MB size range. Uncompressed and compiled in that 400MB size range.

If you have space on another device to make a copy of your system as it is now, or at least part of it. Which you should do for backups anyway. You could take a snapshot now. Take one after a period of time and diff the two. It should give you a good feel for WHAT changed. Then you can dive deeper and figure out by how much, why, where, what's doing it, and stuff. Once you have the two snapshots, you can run the diff on some other machine and keep that one up and doing whatever. lsof and other tools to identify what or who is touching what.

fesake · 07-30-2010, 07:10 AM

You could also try a program called KDirStat to get a visual representation of all this data.

qwertyjjj · 07-31-2010, 10:17 AM

Still monitoring this, the disk size seems to have stopped increasing at 81%, which is strange but will check next week.
Can I create a mount point for /home and move it to the /dev/sda2 drive?
Would I have to restart after doing this?

[root /]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda5 4956284 3785144 915308 81% /
/dev/sda3 4956316 2929420 1771064 63% /var
/dev/sda1 77749 23626 50109 33% /boot
tmpfs 475204 0 475204 0% /dev/shm
/dev/sda2 233345000 36010044 197334956 16% /var/spool/squid
[root /]#

jay73 · 07-31-2010, 10:51 AM

Yes, you could do that quite easily. But even if you did, you'd still have a / partition that is 80% full as your home folder appears to be rather small. Add more packages and you may see fragmentation kicking in.
Not to mention that we still don't know whether it is really /home that is causing your issue. The best approach would be not only to move your home partition to a partition of its own but to grow your / filesystem.