How to find newest files
 

Hi. I just ran some program that filled up my hard disk with something. Is there a way to list the most recently created files on my filesystem so I can delete them?

I think the program was alsaconf. (by the way, any suggestions on how to set up the sound card?)


Thanks!

I tried
du | sort | less

but I couldn't really tell what the culprit was (also didn't do what i intended-- is there a way to get sort to interpret the numbers? I guess getting du to right justify would also work....)

Also, is there a way to monior a program, and say print each file it writes to to a different console?

use (and be patient):
to list files modified in past 10 minutes
to list files modified in past 2 hours
------------
sort -n sorts numbers and sort -rn sorts numbers recursively
------------
alsaconf wouldn't be the one which filled up your HD
------------
please explain your final question better.
------------
cheers :)

The find command is very useful. Do "man find" to see all its capabilities. A couple of the more relevant ones:

"-newer": Used to find files newer than a certain date/time - you can do "touch filename" and put a date/time on it that you want to use as your basis then use that file as the comparison.

"-size": Used to find files of (or greater than) a certain size. Helps you quickly locate the disk hogs.

When you're looking for disk space a good check is always:
"find / -name core -print"
It will find anything named "core". "core" files are created when running programs die badly and are there for debugging purposes. Sometimes these can be quite large. Be careful though because some morons (Oracle being a major culprit) name directories or files "core" that are NOT core dumps. You can tell if it is a core dump by doing "file filename" on the core you find. If it is a core dump it will say something like "core dump from program" and will also usually give you something SIGSEGV or another signal that caused the dump. Real core files are safe to remove.

For du I typically do:

du -sk * |sort -rn

The "-r" says to reverse the order and the "n" (actually "-n") says to do a numeric sort. This will give you what you intended. Without "-n" sort does a string comparison rather than a numeric so it would see 2, 200, 2000 before 3 because all start with the string "2". The numeric sort lets it know that 3 should come after 2 but before 200.

By the way be careful removing files. Sometimes they are log files and if they are actually "open" by a process removing them only deletes the name but not the inode so no space is freed. Before removing a file you think may be "open" run "fuser filename" (or better yet "lsof filename") to see if anything has it open.

thanks for all your help, I'm still looking, though, it may be tough. At the beginning of the day, I had 80 mb free (the whole disk is 720 mb). The reason that I think the culprit is alsaconf, is that I used the option to scan for every ISA sound driver at every port and irq possible ('cause I had no idea what/where the soundcard was--- note to self: the easy way to do this is with google, found it in about 10 seconds ;) ) and it printed about a zillion messages, and there was disk activity (I stupidly left it unnattended for some time). It might help to know where alsaconf would put the files, or if there is an error log somewhere that it filled up.

to clarify my last question, is there a way to say start a program (say "A"), and then start another program, "B" in another console, with the following behaviour:
Whenever "A" acceses or writes a file (say "F"), "B" prints "Process A accessed file F at 10:59:36 PM" or something of the sort.

update:
I found it! it was in /var/log/ksymoops/
the files were called 20051026170***.(modules or ksyms)

I deleted the whole directory, hopefully my system will survive a reboot! :D

Just wondering if anyone can refer me to a program that does what I described in the last post. :)