[PLUG] Sudden massive disk activity eats 9 GB

[John Jason Jordan]

On Tue, 07 Dec 2010 01:37:06 -0800
Russell Senior <russell at personaltelco.net> dijo:

>John> I'd like to know what it is, i.e., what crashed and why. I'd
>John> also like to delete it, since I doubt I need it. Of course, it
>John> might not be just one file. I used ls to locate the most recent
>John> files with -t, but it's not locating the file(s), nor is the -S
>John> parameter. I could use some suggestions for how to sleuth out
>John> what happened. 
>
>$ find / -mtime -1
>
>will list the files with a modification timestamp in the last 24
>hours, -mmin does the same thing except in units of minutes instead of
>days.  If the argument is negative, it means to match things "less
>than" that much old.  See "man find" for details.  

It gave me many dozens of pages (windows) of files. I need to combine
it somehow so it shows only files of a certain size or larger. I tried
man find earlier, but it's too much and hard to follow.

This isn't tested
>but if it works, it'll show you the top 10 files by size modified in
>the last 24 hours:
>
>$ find / -type f -mtime -1 -exec ls -l '{}' \; | sort -k 5nr | head

If I run it as jjj it just gives me "permission denied" on every
folder. As root it appears to run, but the hard disk light never comes
on, making it look like it is hung:

# find / -type f -mtime -1 -exec ls -l '{}' \; | sort -k 5nr | head 
find: `/home/jjj/.gvfs': Permission denied
^C
# 

Actually, there are probably few files that approach the size I am
looking for, regardless of the time stamp. 

<Later>

OK, I nailed it. First I did "find -size +1G." This gave me a bunch of
Virtualbox files (which I expected), but at the very top of the list
was a coredump file in the abrt folder:

[root at Devil8 /]# find -size +1G
<snipped irrelevant files>
./var/spool/abrt/ccpp-1291706342-2244/coredump

Then, navigating to that folder:

[root at Devil8 ccpp-1291706342-2244]# ls -la
total 8389624
<snipped a bunch of small files>
-rw-r--r--  1 root root 8608116736 Dec  6 23:43 coredump

I guess the numbers in there mean it is about 8.6 GB. And it was ABRT
that popped up a message when the disk activity stopped that some file
was too large. So that file is undoubtedly what I was looking for.

I haven't deleted it yet because I want to know if there is a way to
peer inside it to get information about what caused it to be created.