Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there a way under linux to find out directory with frequent writes and/or deletes?

I'm using Ubuntu and recently bought SSD. I moved /tmp to ramdisk and did some other tweaks to avoid wear. But I was wondering if there's a way to pinpoint hotspots in filesystem where files are often written. For example webserver's log directory with many appends every minute or user's download directory where he downloads gigabytes of stuff only to be moved elsewhere soon after finishing.

I came across inotify which could probably do the trick but it seems it'd require lot of scripting which I'm not very familiar with :-/

share|improve this question

The audit subsystem can tell you which files get accessed the most.

share|improve this answer
ok, I'll give it some googling – höken Jun 20 '11 at 17:07
up vote 1 down vote accepted

After some googling and fiddling I came accross great example of using inotify on IBM developerWorks. The example app might be crude but basically does what I needed. I guess I'll start with it and polish some details like recursive scanning, making it less verbose, adding hitcounter and stuff.

share|improve this answer

Which files get accessed the most is not going to help you determine which parts of your SSD get the most wear, as files move around a lot... not only that, but most flash and SSD products implement wear leveling to move heavily-written blocks around so that one part of your drive won't wear out before another.

share|improve this answer
Yes, I'm aware that SSD shuffles data around. The point is to find and link these hot spot directories to normal HDD. Imagine your webserver producing 10GB log per day before it's automatically zipped and moved to another location. That 10GB write might be significant if SSD is running low on free space – höken Jun 20 '11 at 6:30
Ah, gotcha. Well, for starters, I wouldn't put any logs on my SSD... unless you need really fast logs for some reason. In fact, SSD will be most advantageous for files that are read and written the most. But I realize that doesn't really answer your question. – Flimzy Jun 20 '11 at 6:42

Find which files were written to in the last day: find / -xdev -mtime -2 (with some false positives for metadata updates). If you have an incremental backup (rsync-like) you could look at which files need to be re-sent.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.