To investigate why the disk space on your Ubuntu server decreased significantly at a specific time, you can follow these steps:
- Check System Logs: System logs can provide insights into what processes were running at that time. Look into logs like
/var/log/auth.log, and other relevant logs in
/var/log/directory. Use commands like
awkto filter logs around the specific time.
grep 'Nov 20 11:' /var/log/syslog
- Analyze Cron Jobs: Check if any cron jobs were scheduled to run at that time which might have created or downloaded large files. You can view cron jobs with:
And also check system-wide cron jobs in
/etc/crontab and the
- Review User Activity: If you have multiple users, check their activity around that time. Look into their bash history if possible:
- Disk Usage Tools: Use tools like
ncduto analyze which directories grew in size. For instance, you can see the size of directories in
du -h --max-depth=1 /var
- Check for Large Files: Find recently modified large files using
find / -type f -size +100M -mtime -2
This command finds files larger than 100MB modified in the last 2 days.
- Database Logs: If you have databases running, check their logs as well. They might have performed large operations or backups.
- Network Activity Logs: If the server downloads data from the internet, check logs of applications like
curl, or any other custom scripts that might have downloaded large amounts of data.
- System Updates: Sometimes system updates or automatic software installations can consume disk space. Check
/var/log/apt/history.logfor any recent installations or upgrades.
- Backup and Snapshot Systems: If you have any backup systems or snapshot tools (like Timeshift), they might have created backups or snapshots at that time.
- External Monitoring Tools: If you have any monitoring tools installed, like
zabbix, or a custom monitoring solution, check their logs and reports.
Investigating disk space issues often requires correlating data from multiple sources. If you find a specific large file or a process that consumed the space, you can then delve deeper into why it happened and how to prevent it in the future.