3 Replies Latest reply on Oct 26, 2011 11:05 AM by Mike Langhorst

    Fileserver "files" directory filling - what's creating?

      One of my users has created a number of server audits, that I'm assuming are creating a number of files/directories on the fileserver.  Where the base directory is /app/nsh/storage, these directories are under /app/nsh/storage/files.  The directory and filenames are all seemingly unrelated numbers, definitely no relation to the actual filename on the originating host. 

       

      Example:

      drwxr-xr-x   3 root     root          80 Sep  6 08:20 2398496

      # ls -lR 2398496

      2398496:

      total 0

      drwxr-xr-x   4 root     root          80 Sep  6 08:20 3

       

      2398496/3:

      total 16

      drwxr-xr-x   2 root     root        1024 Sep  6 08:20 2269077

      drwxr-xr-x   2 root     root          80 Sep  6 08:20 2269086

       

      2398496/3/2269077:

      total 288

      -rwx------   1 root     root        3485 Sep  6 08:20 11

      -rwx------   1 root     root        3485 Sep  6 08:20 12

      -rwx------   1 root     root        3485 Sep  6 08:20 13

      -rwx------   1 root     root        3485 Sep  6 08:20 14

      -rwx------   1 root     root        3485 Sep  6 08:20 15

      -rwx------   1 root     root        3506 Sep  6 08:20 16

      -rwx------   1 root     root        3506 Sep  6 08:20 17

      -rwx------   1 root     root        3458 Sep  6 08:20 18

      -rwx------   1 root     root        3470 Sep  6 08:20 19

      -rwx------   1 root     root        3470 Sep  6 08:20 20

      -rwx------   1 root     root        3483 Sep  6 08:20 21

      -rwx------   1 root     root        3483 Sep  6 08:20 22

      -rwx------   1 root     root        3487 Sep  6 08:20 23

      -rwx------   1 root     root        3488 Sep  6 08:20 24

      -rwx------   1 root     root        3488 Sep  6 08:20 25

      -rwx------   1 root     root        3489 Sep  6 08:20 26

      -rwx------   1 root     root        3489 Sep  6 08:20 27

      -rwx------   1 root     root        3489 Sep  6 08:20 28

       

      2398496/3/2269086:

      total 16

      -rwx------   1 root     root        6688 Sep  6 08:20 66

       

      From looking at these files, it appears he has a component template configured wrong, not excluding some transient data/log files.  The problem is, he doesn't know either what job is creating it.  At times these directories can be 15-20GB for several days at a time.  I've searched for the numbered string in the logs, hoping to find a log entry where this was written, but with no results

       

      How can I identify what is creating these files?