A common task for system administrators is determining what has filled up a full filesystem.

Here are some of my favorite commands to figure out why a filesystem is full…

#1 – du -sm ./* | sort -n

With this command, you first CD in to the filesystem that is full.  You then run:

du -sm ./* | sort -n

This command will show the sizes everything in the directory, sorted by size (in MB).  Subdirectories show their total size, so you can use this command to quickly find and drill down to deep subdirectories that are taking a lot of space.

Here is an example, that shows the “freeware” sub-directory is taking 377 MB of space.  We can CD to that directory and run the same command again to see what in the “freeware” directory is taking so much space.   You can repeat this until you have drilled down several directories.

/opt # du -sm ./* | sort -n
0.00    ./cam
0.00    ./lost+found
0.00    ./mcr
0.02    ./hsc
0.05    ./RPM_inst_root
0.20    ./perl
0.49    ./pconsole
0.53    ./diagnostics
0.78    ./IBM
1.57    ./Tivoli
11.25   ./IBMinvscout
17.12   ./csm
18.85   ./ibm
24.07   ./tivoli
48.29   ./LicenseUseManagement
377.80  ./freeware
/opt #
/opt #
/opt # cd freeware
/opt/freeware #
/opt/freeware # du -sm ./* | sort -n
0.00    ./64
0.00    ./src
0.00    ./var
0.04    ./include
0.11    ./sbin
0.16    ./etc
0.47    ./info
1.47    ./packages
1.91    ./man
9.82    ./bin
10.35   ./doc
33.66   ./share
69.14   ./cimom
72.27   ./lib64
178.41  ./lib
/opt/freeware #

#2 – Find based on size

You can use the “find” command to search a filesystem to find large files.  I especially like the “-xdev” flag which tells find to not traverse in to directories that are not part of the filesystem you are searching on.   This is especially useful when your “/” (root) filesystem fills up because if you do a “find” on “/” without -xdev it will search every filesystem on the system since they are mounted under “/”.  But with “-xdev” it will only search what is actually in the “/” filesystem and skip everything else.

Find all files larger than 1 MB:

find /tmp -xdev -size +echo 1024*1024 | bcc -ls

Find all files larger than 40 MB:

find /tmp -xdev -size +echo 1024*1024*40 | bcc -ls

Find all files larger than 1 GB:

find /tmp -xdev -size +echo 1024*1024*1024 | bcc -ls

Note that I’m just doing simple math with “bc” to calculate the byte size.  For example, if you wanted 500 MB it would be 1024*1024*500.  If you wanted 50 GB it would be 1024*1024*1024*50.

#3 – Find based on modification date

You can also use “find” to show files recently modified.   Here are some examples:

Find all files modified in the last 60 minutes (mmin is minutes):

find /tmp -xdev -mmin -60 -ls

Find all files modified in the last 5 days (mtime is days):

find /tmp -xdev -mtime -5 -ls

Post a comment with your favorite commands you use to find what’s filling up your filesystems.