Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is an actual cPanel server but the info here will probably relate to others so I thought it would make a good question.

The drive is constantly filling up. You've hunted down all the spare and random files you can. grep'd for coredump files and even removed some of the un-needed backups...

What would be your next move.

The actual server in question has 10GB of website files and the OS shouldn't take any more than 10GB so how do you track down what's filling a 50GB (virtual) drive?

share|improve this question
add comment

8 Answers

up vote 7 down vote accepted

I find ncdu (http://dev.yorhel.nl/ncdu) to be quite helpful for this.

share|improve this answer
    
Perfect. Brilliant interface and the ability to manipulate files from within the programme. Cheers! –  gyaresu Aug 3 '09 at 23:24
add comment

Surely there are more elaborate ways, but the one I remember is

du --max-depth=1 -h /

Now take the directory that uses up most space (du --max-depth=1 -h /yourdir) and go deeper until you find your culprit.
If want your output sorted by size and don't care for the human-readable format, you could also do du --max-depth=1 /your_dir | sort -n

share|improve this answer
    
Yeah. I do pretty much the same thing "du -S | sort -n -r |less". I really would love to see a programme that looked like htop and cron'd like mlocate but when ran gave you accurate and contemporary info about the files on your system. –  gyaresu Jul 21 '09 at 1:17
1  
Instead of starting from / on webserver try starting from http_root. If there is no success there then one can go for '/'. Directory running du on '/' will take lot of time. –  Saurabh Barjatiya Jul 21 '09 at 5:43
add comment

If you can run software on the system, then xdiskusage will graphically show you which directories/files are eating your space. Extremely useful.

I believe KDE contains something similar.

If it's text-only and you cannot install extra software, then creative use of du will probably get you there as well.

share|improve this answer
add comment

df -k shows which fs are the problem. Then cd to the top level dir for it and run du -xk | sort -n | tail -25 this will show the top 25 dir, sorted, for sun 9 or earlier, replace the x with a d.

share|improve this answer
    
Yeah, similar to what I just mentioned in @Marie Fischer's answer. Why use the -k (block size) though rather than -h for human? –  gyaresu Jul 21 '09 at 1:24
    
-k is used so that all sizes are reported in kb. This is useful for sort else sort would put 10kb before 20mb while sorting. –  Saurabh Barjatiya Jul 21 '09 at 5:41
add comment

Give gt5 a try.

share|improve this answer
    
I second this, it is great for tracking where space is going because it shows diffs. –  Josh Jul 21 '09 at 3:38
add comment

here's something I cobbled together to track down some rogue processes on our database servers: rabbitfinder

#!/bin/sh
tree -s -f > /tmp/out1 && sleep 5 && tree -s -f > /tmp/out2; diff /tmp/out1 /tmp/out2 | egrep "\|--" | awk -F[ '{print $2}' | awk -F] '{print $2 }' | sort | uniq | xargs fuser -f | xargs ps -lFp

it's kinda kludgey and not very robust, but it works thusly:

  1. generate a recursive tree list of the current directory
  2. wait 5 seconds
  3. generate another list
  4. compare the two outputs
  5. fuser the files that have changed size and
  6. ps -lFp the files to show what process owns them

    user@poseidon:~$ tree -s -f > /tmp/out1 && sleep 5 && tree -s -f > /tmp/out2; diff /tmp/out1 /tmp/out2 | egrep "\|--" | awk -F[ '{print $2}' | awk -F] '{print $2 }' | sort | uniq | xargs fuser -f | xargs ps -lFp ./tmp/output:
    F S UID PID PPID C PRI NI ADDR SZ WCHAN RSS PSR STIME TTY TIME CMD 0 R 1000 14310 14275 23 80 0 - 1072 - 748 1 22:19 pts/2 00:00:06 dd if /dev/zero of ./output bs 1024 count 10000000

share|improve this answer
add comment

I use the Gnome program baobab. You can run this on your desktop and t can connect via SSH to the server. It shows an easy to read graphical map of disk space usage. It's installed under Gnome as "Disk Usage Analyzer"

share|improve this answer
add comment

Note that files can be deleted while still being written to, so they use diskspace while their creating process is running, but not have a filename.

This makes it unfindable with the usual tools - you can use lsof to investigate which processes have open files.

share|improve this answer
    
I use /usr/sbin/lsof | grep deleted to get this. –  Kevin M Jul 21 '09 at 12:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.