I ran some code that caused root file system to run out of space; the code then crashes and the file is deleted. I need to find out which file is being created there.

How can I quickly (while the program is running, i.e., I only have ~30 seconds) find all files in the given file system that are greater than 1 GB and modified or created just now?

(I'm guessing python's sqlite3 uses root file system for something, but obviously without seeing the file I have no way of knowing.)

  • 1
    Have you considered instead using lsof to list all files that the program opens for writing? See for example lsof: show files open as read-write Mar 31 '16 at 22:53
  • @steeldriver just tried. the only open file is in /var/tmp, but it shows as "deleted": python 24853 max 6u REG 8,1 3821580012 788060 /var/tmp/etilqs_xARlZag1jj945jH (deleted). It's also far bigger than the space on the root filesystem. Still, the root filesystem slowly reduces its free space until it hits 0.
    – max
    Apr 1 '16 at 15:26

With the following command you can find the recently modified/created file on the system disregarding the file size:

find ${1} -type f -size +1G| xargs stat --format '%Y :%y %n' 2>/dev/null | sort -nr | cut -d: -f2-
  • It works correctly (in the sense of finding other files), but still doesn't find any files being created while the process is running. Then I just get the message "The volume Filesystem root has only 200 MB disk space remaining", and df command really shows / is almost full while /home has 50 GB free.
    – max
    Mar 31 '16 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.