Re: locating the source for hdd activity

[Jeff <jcoppock1@attbi.com>]

Charlie Reiman, 2002-Nov-18 18:07 -0800:
> Did you try the find command I suggested?
> 
> Try something like (in a script, run as root):
> 
> sleep 310; find / -mount -type f -mmin -5
> find /usr -mount -type f -mmin -5
> find /home -mount -type f -mmin -5
> 
> Run it, then leave your computer alone until the script complete. It should
> list all files modified in the last 5 minutes. I was able to figure out
> samba was active every couple of minutes that way. Most likely you'll find
> something in /var is getting touched.
> 
> It is unlikely that something is reading a file over and over but it might
> be possible. You could temporarily reenable atimes and change the find
> command to see if it finds anything.
> 
> There is also the possibilities that something is just creating and deleting
> a file in which case you could remove the '-type f' from the find commands
> above to hunt for directories as well.
> 
> And there is always 'lsof'. That might help you find something.

Ah.  I didn't get what that was about.

I ran the find command for each mount and then ran the script with the
5 minute timer and found that Mozilla was doing some cache stuff in my
home directory and cups is doing something with /etc/cups/certs/0.

I'm also trying it without the -type f, as you suggest, and finding
postfix is doing stuff with /var/spool/postfix/public/pickup and
/var/spool/postfix/public/qmgr.

So, I have some figuring to do.

Thanks for your help.

jc


--
Jeff Coppock		Systems Engineer
Diggin' Debian		Admin and User