Re: [PLUG] How to Find Most Used Files

[Doug Stewart <zamoose@gmail.com>]

Also, dunno why I didn't think of them, but what about `auditd` and/or
cron'd `find` with a relatively short -atime value?

On Sun, Nov 20, 2011 at 10:20 PM, Doug Stewart <zamoose@gmail.com> wrote:
> Have you looked into sar/sysstat?
>
> On Sun, Nov 20, 2011 at 3:20 PM, Rich Freeman <r-plug@thefreemanclan.net> wrote:
>> On Sun, Nov 20, 2011 at 2:53 PM, brent timothy saner
>> <brent.saner@gmail.com> wrote:
>>> 3. THIS IS IMPORTANT: you MUST have the disk mounted with the "atime"
>>> option, otherwise you'll have to rely only on modified time in the find
>>> command (mtime). i believe noatime is now the default, which means
>>> atimes aren't updated.
>>
>> There is a reason for that - updating atimes results in a LOT of extra
>> disk writes and a performance hit.  It potentially increases flash
>> wear as well if you have an SSD.  No real way to get around that with
>> this type of solution.
>>
>> I could envision a program aggregating from lsof or something like
>> that, or using a file-alteration-monitor or direct accounting calls to
>> the kernel.  That wouldn't require quite as many updates since you
>> could flush the log once an hour or whatever.  I have no idea if such
>> a thing already exists though.
>>
>> Rich
>> ___________________________________________________________________________
>> Philadelphia Linux Users Group         --        http://www.phillylinux.org
>> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
>> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
>>
>
>
>
> --
> -Doug
>



-- 
-Doug
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug