I'd like to know, which files/directories have been created in a certain time frame (e.g. the last 7 days) that have contributed significantly to an increase in disk usage.

Output similar to

du /root -ah --max-depth 2 --time

would be sufficient, e.g.

$ show-disk-usage /root --since 2020-12-01 --till now --max-depth 2
1,1M    2020-12-01 03:41    /root/dir1/sub1
2,0M    2020-12-12 05:46    /root/dir1/sub2
3,2M    2020-12-09 17:01    /root/dir1/file
6,3M    2020-12-12 05:46    /root/dir1
1,1M    2020-12-01 03:41    /root/dir2/sub1
2,0M    2020-12-10 21:30    /root/dir2/sub2
3,2M    2020-12-09 17:01    /root/dir2/file
6,3M    2020-12-10 21:30    /root/dir2
12,6M   2020-12-12 05:46    /root

with the 3 columns

disk-usage-sum-of-modified-files   last-modification-time   file-or-directory-path

Unlike du only the files in the given time frame should be shown and added to the sum of their directory. E.g. a file /root/dir1/file2 modified on 2020-08-01 12:01 of size 9,8M should not change the output of the example given above.

Bonus: An option --threshold like du --threshold 1M would be great to get only files that contributed significantly to an increase in disk usage. However, this option should not change the sum of the directory, since smaller files may accumulate to consume a large amount of disk space.

Bonus 2: Instead of modification time it may be better to use creation time of files, since a small change of a large file may not be what you are looking for. Options --created-since, --created-till, --modified-since and --modified-till would be an improvement.

Note: The solution does not have to be a command line application.


You can combine find and du to do this

find /home/vtrefny -type f -mmin -$((7 * 24 * 60)) -printf "%p\0" | du -h -t 1M --time --files0-from=-

find arguments

  • -mmin -- files last modified X minutes ago (cmin and amin can be used for creation/access time)
  • -$((7 * 24 * 60)) -- 7 days in minutes
  • -printf "%p\0" -- print file path with trailing NUL byte (du needs it)

du arguments

  • --time -- print last modification time (--time=<ctime/atime> can be used for creation/access time) .
  • --files0-from=- -- read file list from stdin (provided by find here)
  • Thanks, is it possible to define depth? If I append --max-depth it does not change the output.
    – maiermic
    Dec 12 '20 at 7:49
  • It also does not show the sum of directories.
    – maiermic
    Dec 12 '20 at 7:53
  • 1
    You can get the sum with -c with du but that's just total sum, I'm afraid this wont work for the individual directories. Dec 12 '20 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.