Ubuntu – Festplattenfresser feststellen

NCDU

To investigate why the disk space on your Ubuntu server decreased significantly at a specific time, you can follow these steps:

1. Check System Logs: System logs can provide insights into what processes were running at that time. Look into logs like /var/log/syslog, /var/log/auth.log, and other relevant logs in /var/log/ directory. Use commands like grep or awk to filter logs around the specific time.

   grep 'Nov 20 11:' /var/log/syslog

2. Analyze Cron Jobs: Check if any cron jobs were scheduled to run at that time which might have created or downloaded large files. You can view cron jobs with:

   crontab -l

And also check system-wide cron jobs in /etc/crontab and the /etc/cron.* directories.

3. Review User Activity: If you have multiple users, check their activity around that time. Look into their bash history if possible:

   cat /home/username/.bash_history

4. Disk Usage Tools: Use tools like du and ncdu to analyze which directories grew in size. For instance, you can see the size of directories in /var or /home:

   du -h --max-depth=1 /var

5. Check for Large Files: Find recently modified large files using find:

   find / -type f -size +100M -mtime -2

This command finds files larger than 100MB modified in the last 2 days.

6. Database Logs: If you have databases running, check their logs as well. They might have performed large operations or backups.
7. Network Activity Logs: If the server downloads data from the internet, check logs of applications like wget, curl, or any other custom scripts that might have downloaded large amounts of data.
8. System Updates: Sometimes system updates or automatic software installations can consume disk space. Check /var/log/apt/history.log for any recent installations or upgrades.
9. Backup and Snapshot Systems: If you have any backup systems or snapshot tools (like Timeshift), they might have created backups or snapshots at that time.
10. External Monitoring Tools: If you have any monitoring tools installed, like nagios, zabbix, or a custom monitoring solution, check their logs and reports.

Investigating disk space issues often requires correlating data from multiple sources. If you find a specific large file or a process that consumed the space, you can then delve deeper into why it happened and how to prevent it in the future.