0

I ran some code that caused root file system to run out of space; the code then crashes and the file is deleted. I need to find out which file is being created there.

How can I quickly (while the program is running, i.e., I only have ~30 seconds) find all files in the given file system that are greater than 1 GB and modified or created just now?

(I'm guessing python's sqlite3 uses root file system for something, but obviously without seeing the file I have no way of knowing.)

2
  • 1
    Have you considered instead using lsof to list all files that the program opens for writing? See for example lsof: show files open as read-write Mar 31, 2016 at 22:53
  • @steeldriver just tried. the only open file is in /var/tmp, but it shows as "deleted": python 24853 max 6u REG 8,1 3821580012 788060 /var/tmp/etilqs_xARlZag1jj945jH (deleted). It's also far bigger than the space on the root filesystem. Still, the root filesystem slowly reduces its free space until it hits 0.
    – max
    Apr 1, 2016 at 15:26

1 Answer 1

1

With the following command you can find the recently modified/created file on the system disregarding the file size:

find ${1} -type f -size +1G| xargs stat --format '%Y :%y %n' 2>/dev/null | sort -nr | cut -d: -f2-
1
  • It works correctly (in the sense of finding other files), but still doesn't find any files being created while the process is running. Then I just get the message "The volume Filesystem root has only 200 MB disk space remaining", and df command really shows / is almost full while /home has 50 GB free.
    – max
    Mar 31, 2016 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .