Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I get the last 10 files that were modified on my system. I have a system where its disk usage is maxed out I am not sure which files is increasing rapidly.

I have a mysql instance stored on a separate mounted device and I just created a softlink unto my /var/lib directory on my root device. I know symlinks does not affect disk usage.

share|improve this question

You can use find, stat, sort, and tail to do that.

find . -exec stat --format="%X" + | sort -n | tail -n 10

However, you might consider using watch and du. watch will run a command periodically (every 2sec by default). And du shows disk usage. This command will show you the disk usage of every file and folder in the current directory, and the output will continuously be refreshed.

watch "du -s *"

You can start at root and see which folder is increasing the quickest, then progress down the folder hierarchy until you find the culprit(s).

If you're in a folder that has too many files to see on the screen at once, you can limit it by segregating the files like du -s [a-h]*. Also, this won't show hidden files; for that you need .* or .[a-h]*, etc.

share|improve this answer
Hi when I run your first command I get this. find: missing argument to `-exec' – Aivan Monceller Oct 18 '11 at 10:13

You could put together a find+sort+... etc. command to do what you ask quite literally. But to achieve the goal of finding the top-disk-usage program, better use iotop.

share|improve this answer

You may want to try live monitoring with either LoggedFS or Linux's audit subsystem (or your unix variant's equivalent feature). See this answer for more information. Note that if a lot of programs use this filesystem, this will produce a lot of logs. Make sure that you aren't logging to the watched filesystem. With the audit subsystem, this rule should do the trick.

auditctl -a exit,always -F dir=/mount/point -S write
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.