Cheap way to track disk usage?

[Richard Hector <richard@walnut.gen.nz>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

I have an issue with a (client's) large (13T) filesystem, that fills
up every now and then and nobody's quite sure what's doing it.

I can run du, but that takes ages, and has a performance impact. df
only gives the total for the filesystem, of course.

Currently I'm running find occasionally, with fprintf to record
filename, mtime and size, then analysing it (by importing it into
postgres, fwiw) for new large files - but ideally I'd like to zero in
by frequently checking sizes of whole directories. Is there any way to
do that, perhaps by triggering off write calls, cheaply?

I know that inotify/incron have their limitations when working with
deep directory structures; I'd be interested to know of anything that
can trigger on any writes to a particular filesystem.

If I could start again, I'd put LVM on the array and use multiple LVs
to allow du to work at lower levels, but that's not really practical
at this stage.

Any tips?

Richard
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBAgAGBQJU9WLxAAoJELSi8I/scBaNKpYIAKzgw6vQ8vzt09mqcuJoZzlU
Ie4hQ4JomV2Jlwe83xpBZ+N2W607mVEWbfEMaYbDzyzA+sSPn12TNP7yWIokUWyj
xnYdMFbDQEvCV7UUR8FeuHclyt3T5IA9kliKG8syUSXBuuZbaEUyP5OlDBxblEo1
dRnEpg066WDRu1VLpJrH9WKB98wb527D80jqV1Y6ZzrOVYnPXWwS9zbU8sSBUusi
R1nKmouE4HL7qmqHeYY3Vu28Aia9wF2GCVKJ9dbqyCIP+EQAGQ1i/XMC7734LK8l
vMitqIQf6XIcN+aEHvH8Bnkxcl8zcAeknqyL6ItuKneldPRLDsmh1wv0zRab23c=
=08Do
-----END PGP SIGNATURE-----