Shell script for filesystem usage analysis

scripting

When filesystem is growing up, we need to analyse what is going on and why is our filesystem running out of space. The best for checking usage is combination of commands like df, du or find. to have it all in one place I wrote very simple and useful script which show largest files, largest directories or last attached/modified files.

This script is intended for Linux OS and tested on SuSE distro.
Here is the script:

#!/bin/sh
#
# script for filesystem usage analysis
#
echo FS:; read FS;

MNT=`cat /proc/mounts | grep -vE -w "nfs|auto.direct" | grep $FS[[:space:]] | wc -l`;

if [[ $MNT == 1 ]]; then
echo;
df -k $FS; echo;

echo "LAST MODIFIED FILES:";
find $FS -xdev -mtime -3 -type f -exec ls -als {} \; 2> /dev/null | sort -n | tail -n 15;

echo; echo "LARGEST FILES:";
find $FS -xdev -size +3145728c -type f -exec ls -als {} \; 2> /dev/null | sort -n | tail -n 15;

echo; echo "LARGEST DIRECTORIES:";
du -xk $FS/* |sort -nr |head -30;

echo; echo "UNLINKED FILES";
lsof +aL1 $FS;

echo;
else
echo "filesystem $FS not found in kernel table";
exit;
fi

unset FS

And here is output of the script. At the end we can see some deleted files but still hold by process.

system1:/depot/scripts/sh # ./checkfs.sh
FS:
/var

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/vg00-lv_var 1032088 221292 758368 23% /var

LAST MODIFIED FILES:
76 -rw-r--r-- 1 root root 70230 Apr 2 07:57 /var/log/boot.msg
76 -rw-rw---- 1 mysql mysql 70681 Apr 1 11:16 /var/lib/mysql/mysql-bin.000174
100 -rw-r--r-- 1 root root 94225 Apr 2 07:57 /var/log/ConsoleKit/history
112 -rw-r--r-- 1 root root 106757 Apr 2 08:18 /var/log/apache2/error_log
136 -rw-rw---- 1 mysql mysql 132096 Apr 1 11:16 /var/lib/mysql/wiki/searchindex.MYI
140 -rw-rw---- 1 mysql mysql 137692 Apr 1 09:31 /var/lib/mysql/wiki/searchindex.MYD
216 -rw------- 1 root root 217016 Apr 2 08:00 /var/run/nscd/services
216 -rw------- 1 root root 217016 Apr 2 10:10 /var/run/nscd/group
216 -rw------- 1 root root 217016 Apr 2 10:37 /var/run/nscd/passwd
232 -rw-rw-r-- 1 root tty 230016 Apr 2 10:05 /var/log/wtmp
272 -rw-r----- 1 root root 272136 Apr 2 07:57 /var/log/warn
1888 -rw-r----- 1 root root 1926939 Apr 2 10:25 /var/log/messages
2628 -rw-r--r-- 1 root root 2683821 Apr 2 10:14 /var/log/apache2/access_log
5132 -rw-rw---- 1 mysql mysql 5242880 Apr 2 10:14 /var/lib/mysql/ib_logfile0
34856 -rw-rw---- 1 mysql mysql 35651584 Apr 2 10:14 /var/lib/mysql/ibdata1

LARGEST FILES:
36 -rw-r--r-- 1 root tty 5840876 Apr 2 10:05 /var/log/lastlog
3636 -rw-r--r-- 1 root root 3715336 Mar 27 14:21 /var/log/YaST2/y2log
3660 -rw-rw---- 1 mysql mysql 3741322 Aug 4 2014 /var/lib/mysql/mysql-bin.000020
5132 -rw-rw---- 1 mysql mysql 5242880 Apr 2 10:14 /var/lib/mysql/ib_logfile0
5132 -rw-rw---- 1 mysql mysql 5242880 Dec 11 13:57 /var/lib/mysql/ib_logfile1
6856 -rw-r--r-- 1 root root 7004811 Jun 27 2014 /var/log/YaST2/y2log-1
8344 -rw-r--r-- 1 root root 8524366 Jul 4 2014 /var/adm/backup/rpmdb/Packages-20140704.gz
8412 -rw-r--r-- 1 root root 8596030 Aug 7 2014 /var/adm/backup/rpmdb/Packages-20140807.gz
8436 -rw-r--r-- 1 root root 8620520 Aug 15 2014 /var/adm/backup/rpmdb/Packages-20140815.gz
8456 -rw-r--r-- 1 root root 8639621 Aug 17 2014 /var/adm/backup/rpmdb/Packages-20140817.gz
8468 -rw-r--r-- 1 root root 8652347 Sep 19 2014 /var/adm/backup/rpmdb/Packages-20140919.gz
26160 -rw-r--r-- 1 root root 26759168 Sep 19 2014 /var/lib/rpm/Packages
34856 -rw-rw---- 1 mysql mysql 35651584 Apr 2 10:14 /var/lib/mysql/ibdata1

LARGEST DIRECTORIES:
113740 /var/lib
66700 /var/lib/mysql
43968 /var/adm
42908 /var/adm/backup
42124 /var/adm/backup/rpmdb
32136 /var/lib/rpm
18472 /var/log
13412 /var/lib/sfcb
13232 /var/lib/sfcb/registration
10828 /var/log/YaST2
9852 /var/cache
6688 /var/lib/sfcb/registration/repository
6684 /var/lib/sfcb/registration/repository/root
6508 /var/lib/sfcb/registration/repository.previous
6504 /var/lib/sfcb/registration/repository.previous/root
4712 /var/cache/man
4208 /var/cache/zypp
3056 /var/lib/sfcb/registration/repository/root/cimv2
3056 /var/lib/sfcb/registration/repository.previous/root/cimv2
2748 /var/log/apache2
2532 /var/cache/zypp/solv
2424 /var/lib/sfcb/registration/repository/root/suse
2244 /var/lib/sfcb/registration/repository.previous/root/suse
1712 /var/cache/zypp/solv/SUSE-Linux-Enterprise-Server-11-SP3 11.3.3-1.138
1648 /var/cache/zypp/raw
1644 /var/cache/zypp/raw/SUSE-Linux-Enterprise-Server-11-SP3 11.3.3-1.138
1460 /var/cache/zypp/raw/SUSE-Linux-Enterprise-Server-11-SP3 11.3.3-1.138/suse
1456 /var/cache/zypp/raw/SUSE-Linux-Enterprise-Server-11-SP3 11.3.3-1.138/suse/setup
1452 /var/cache/zypp/raw/SUSE-Linux-Enterprise-Server-11-SP3 11.3.3-1.138/suse/setup/descr
1216 /var/cache/man/local

UNLINKED FILES
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
mysqld 5152 mysql 4u REG 253,7 0 0 49436 /var/tmp/mysql.XoRoJg/ibYR8VeL (deleted)
mysqld 5152 mysql 5u REG 253,7 0 0 49442 /var/tmp/mysql.XoRoJg/ibbI4cLl (deleted)
mysqld 5152 mysql 6u REG 253,7 0 0 49446 /var/tmp/mysql.XoRoJg/ibD31ShW (deleted)
mysqld 5152 mysql 7u REG 253,7 0 0 49452 /var/tmp/mysql.XoRoJg/ibM8DvUw (deleted)
mysqld 5152 mysql 11u REG 253,7 0 0 49454 /var/tmp/mysql.XoRoJg/ibcNXGtb (deleted)

system1:/depot/scripts/sh #

Leave a Reply