0

On a Linux server (RHEL 6.2) with a 50GB drive, disk usage which is normally around 57% spiked for about an hour to 100%. It has returned to normal again.

Is there some way to find out what files were created or deleted around that time?

Liam
  • 1,401
  • 3
  • 19
  • 28

1 Answers1

1

As detailed @ http://xmodulo.com/2012/11/how-to-find-recently-modified-files-on-linux.html

Search for files in /target_directory and all its sub-directories, that have been modified in the last 60 minutes:

find /target_directory -type f -mmin -60

Search for files in /target_directory and all its sub-directories, that have been modified in the last 2 days:

$ find /target_directory -type f -mtime -2

You can also specify the range of update time. To search for files in /target_directory and all its sub-directories, that have been modified in the last 7 days, but not in the last 3 days:

find /target_directory -type f -mtime -7 ! -mtime -3

All these commands so far only print out the locations of files that are matched. You can also get detailed file attributes of recently modified files, using "-exec" option as follows.

To search for files in /target_directory (and all its sub-directories) that have been modified in the last 60 minutes, and print out their file attributes:

find /target_directory -type f -mmin -60 -exec ls -al {} \;

Alternatively, you can use xargs command to achieve the same thing:

find /target_directory -type f -mmin -60 | xargs ls -l
Andy
  • 344
  • 1
  • 8
  • This will however not tell about files created and deleted in the meantime. A search (find /target_dir -type d ... ) may help to identify some directory, but depending on server role, you should maybe look at system / applications / daemons logs to search for events such as backup. – tonioc Sep 17 '14 at 13:55