Pages

Monday, August 5, 2013

Determine the Files Causing The Volumes to Fill Up fast

There are cases where we need to find out what are the files that are causing the Volumes to fill up. This may cause other files not to get updated.
We can always use lsof Command to determine which files are open on the File System.
1.First Determine the Path to the Device for the File System by using the df Command
$ df /config
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/Volume001-config
507748 15744 465790 4% /config
The device is /dev/mapper/Volume001-config.
2.Run the Lsof Command on the Device to see all the Open Files on the Device
remoteMachine:root002-infs $ lsof /dev/mapper/Volume001-config
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
root-set 12436 root mem REG 253,26 15504 131140 /var/logs/tryCatch.log
root-set 12436 root mem REG 253,26 34040 131139 /var/logs/tryCatch1.log
root-set 12436 root mem REG 253,26 5936 131165 /var/logs/tryCatch2.log
Once you get the Files Names and their details , try to run the same command after a minute or so,
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
root-set 12436 root mem REG 253,26 15504 131140 /var/logs/tryCatch.log
root-set 12436 root mem REG 253,26 34040 141139 /var/logs/tryCatch1.log
root-set 12436 root mem REG 253,26 5936 11165 /var/logs/tryCatch2.log
In the above output, the file /var/logs/tryCatch1.log has increased.
You can find the pid of the process that has that file open from the lsof output too.
Using this information, you can determine what files are filling up the filesystem, and also which processes are accessing those files.
Happy learning , More To Come