What's a reliable way to check which files and directories have recently taken up disk space of the root partition?

Question

I already tried things like sudo du -csh * (in the root dir), sudo find /usr/lib/ -type f -printf "%s\t%p\n" | sort -n | tail -10 sudo du -a / --exclude=/media --exclude=/home | sort -n -r | head -n 100 and similar commands. I'm looking for something that is about recent disk space use and that works reliably (even in my use-case).

The problem with these is that because there is "No space left on device" I can't run them - if I free up some disk space (for example by running bleachbit or removing large unnecessary packages or deleting some files in /tmp/) it doesn't take long until that space is taken up as well. I already moved /var/lib/docker which was several GBs in size which were shown to be freed up afterwards - now something must have taken up these GBs worth of disk space.

The second problem is that when I run these commands when I have some free disk space I currently couldn't easily identify which of the files and directories are new and unnecessary. The largest directory seems to be /usr/share.

However, sudo du -csh /usr/share/* | grep "G" only displays that it's 7GB which shouldn't be too large. An earlier output of sudo du -ah / --exclude=/media --exclude=/proc --exclude=/home | sort -n -r | head -n 100 which I stored to another partition only shows files of 1 MB sizes (including in /usr/share/).

---

Is there a good way to nicely and quickly output a list of the largest files and directories which have recently been added, maybe even including processes responsible for that? It would also be useful if one was able to specify another /tmp/ directory for running the command if that's possible. I'm using Debian10/KDE.

A simple and reliable way to list what's recently been taking up disk space would be very handy here.

Update: I was able to show recently modified files in the root directory that are larger than a specified filesize with the preinstalled KFind. I can't exclude directories with it and I can't start veracrypt to unmount a partition because I only get the message "veracrypt is already running". However, I was still able to find the problematic file:

it was /proc/pid/task/pid/fd which was an open instance of the konsole with only one command running where aborting that command did not free up the disk space - I had to close the konsole window with all its tabs and subsequently had several GBs worth of free disk space again.

Answer 1

You can use the above simple commands to get the last modified files and directories using mtime :

# Get files/dirs modified during the last 15 days and then desc  sort with disk usage and print the first 10 lines
find / -mtime -15  | xargs -I {} du -sm {} | sort -rn | head -10
# Get files/dirs modified during the last 60 minutes and then desc sort with disk usage and print the first 10 lines
find / -mmin -60 | xargs -I {} du -sm {} | sort -rn | head -10
# Get files/dirs modified between 2020-12-18 and 2020-12-19 then desc sort with disk usage  and print the first 10 lines
find / -newermt 2020-12-18 ! -newermt 2020-12-19 | xargs -I {} du -sm {} | sort -rn | head -10

If your system is able to store the creation time ; then you can use crtime instead.

Check first on any file that crtime is set :

## Output should be different than - sign
stat -c '%w' <file>

Then you can use the same find command with B option Birth Time :

# Get files/dirs **created** between 2020-12-18 and 2020-12-19 then desc  sort with disk usage and print the first 10 lines
find / -newerBt 2020-12-18 ! -newerBt 2020-12-19 | xargs -I {} du -sm {} | sort -rn | head -10

If your filesystem handles Birth Time but you are not seeing it in stat command, you can check directly on the device level that is holding the files by :

# Getting the inode number
ls -i <file>
# Then get crtime 
debugfs -R 'stat <inode_no>' <device>

There is a python package that was written by @PascalVKooten Stack Overflow thread called crtime that you can use to get the creation time, I don't know if it's recursive (not tested) but it will give you an output like the following :

1552938281  /home/pascal/crtime/.gitignore
1552938285  /home/pascal/crtime/README.md
1552938282  /home/pascal/crtime/crtime
1552938288  /home/pascal/crtime/deploy.py

Then you can sort timestamps by desc order and convert them to date time if you want :

sudo crtime ./ | awk '{print$1}' | sort -rn |  xargs -I {} date -d @{}

Mon Mar 18 20:44:48 +01 2019
Mon Mar 18 20:44:45 +01 2019
Mon Mar 18 20:44:42 +01 2019
Mon Mar 18 20:44:41 +01 2019

Finally, to get the last processes that edited certain files or directories, you can use auditctl and setup a custom rule then query the logs with ausearch.

You can also use inotify-tools to do the same but I think it can seriously affect the memory usage if you do it for the whole root filesystem.

Lsof cannot be used because it concerns the current opened files and not the recent ones.

Also if you are able to use a third party tool, then think about using ncdu with enabling extended information mode to sort by extra attribute like mtime then you can export the output to a file.