From a good friend of mine…
“Howdy everybody!
I have been using the following command for a while now to help figure
out when exactly a partition became full on a server:
grep "Disk check" /var/log/chkservd.log | grep "2014-08-20"
This has been extremely useful for me, and in fact I use it almost every
day I work.
The command can obviously be modified to get other output, to grep for
an entire months period for instance:
grep "Disk check" /var/log/chkservd.log | grep "2014-08"
The log is populated with usage of each partition frequently, and is
almost never removed, so this log can stretch back years.
Using this log you can establish a timeline showing how usage changed
over time, and often knowing the timeline helps you understand what
exactly did the “filling” of the partition.
Here is an example of the commands output:
http://pastebin.com/tFGHU8d1
Everybody I have showed this to has loved it and found it very useful,
so I figured I would tell everybody else that does not already know.
Fin.”
