0

I have a directory in my Cent OS machine where the users would drop in in all their files. I want to find out which user is dropping the large files in the folder.

Day by day this increases & would want to know the large files. Any command for that as I do not wish to check them manually.

Rajadurai
  • 1
  • 1

2 Answers2

1

You'll want to use something like:

while read directory
do
    find "$directory" -size +1M -exec stat --format="%U (id: %u), file: %n" {} \;
done << EOT
/path/to/folder 1
/path/to/my folder 2
EOT

The +1M would look for files over 1M.

The stat format would show a username, its user ID and corresponding file name, for anything find would have matched.

Following up on comments, say I want to filter these on modification time, such as find should not match any file that got modified in the last 24 hours, then I could use:

find "$directory" -size +1M -mtime +1 -exec stat --format="%U (id: %u), file: %n" {} \;
SYN
  • 2,793
  • 12
  • 19
  • Thanks. But how do I find it for the following directory as am unable to check for the same "/aaa/bbb/ccc dddd" – Rajadurai Jan 09 '18 at 09:53
  • I could edit my `/path/to/watch` to `/aaa/bbb/cccc/dddd`, although I'ld probably have missed your point: what do you mean, what "following" directory? – SYN Jan 09 '18 at 12:09
  • Ok. "/home/xxx/yyy zzz" is the respective directory in which I want to know the users dropping large files along with the file details. Pls advice. – Rajadurai Jan 09 '18 at 12:49
  • Note: cccc dddd denotes "sharing folder". Its the same directory & according to your comment cccc & dddd are not different directories. When i try with the same path, it throws me an error that the directory doesn't exist. Hope you get my point! – Rajadurai Jan 09 '18 at 12:51
  • `/aaaa/bbbb/cccc/dddd` has a meaning, and it is not "folder `aaaa` or folder `bbbb` or folder `cccc`". – SYN Jan 09 '18 at 12:56
  • Replace /path/to/watch with that path – Zip Jan 09 '18 at 21:39
  • "find /home/p4/patent/sharing folder -size +1M -exec stat --format="%U (id: %u), file: %n" {} \;" is the command I used but the following is the result, find: `/home/p4/patent/sharing': No such file or directory find: `folder/': No such file or directory – Rajadurai Jan 10 '18 at 11:27
  • You would notice my find command uses double-quotes, which tells find that folder name should be processed as a single argument. Try `"/home/p4/patent/sharing folder"` instead. – SYN Jan 10 '18 at 12:32
  • (to be precise, using double quotes tells your shell, to treat it as a single argument, not `find`) – SYN Jan 10 '18 at 12:41
  • your above command helped me to filter out the large files with the user name & directories. But now I have a requirement where I need to find out the old large files to move/delete them to save space in the server. Because the files that I filtered out are the recent files which cannot be moved nor deleted. – Rajadurai Jan 16 '18 at 05:45
  • @SYN - any updates? – Rajadurai Jan 17 '18 at 08:48
  • It would sound the option you're looking for is `-mtime`, matching files based on modification time. – SYN Jan 17 '18 at 08:50
  • "find "$directory" -size +1M -mtime -exec stat --format="%U (id: %u), file: %n" {} \;" ---- would this be a better command? – Rajadurai Jan 17 '18 at 08:54
  • `mtime` would expect for an argument. I have no idea what you mean by "old age", you'ld want to figure that one out. Right here and now, what you need is `man find`. If your question changed, then edit your initial post. At which point it would make sense for me to update my answer. – SYN Jan 17 '18 at 08:58
0
for i in `cat /etc/passwd | awk -F ":" '$3 >= 500 {print $1}'`; do find path -type f  -size +1M -user $i -exec ls -ltr {} \;; done | awk '{print $3,$NF}'

Above list out the files and username whose file size is greater than 1M. As checked its worked fine. Let me know the update

it will also ignore the files of system users. so only we specified condition cat /etc/passwd | awk -F ":" '$3 >= 500 {print $1}

Praveen Kumar BS
  • 5,139
  • 2
  • 9
  • 14
  • that command did not work out Praveen. It just displayed the next prompt once I execute the above command. – Rajadurai Jan 10 '18 at 12:03
  • @Rajadurai edited the command. Kindly check and let me know for any doubts – Praveen Kumar BS Jan 10 '18 at 15:18
  • that worked but I would need the folder name which has posted the large files rather than the owner. Both also would be helpful. Tried replacing "user" with "name" but it didn't work out. So, basically I need the usernames with the folders posting large files comparing to the previous dates. – Rajadurai Jan 11 '18 at 06:55