I’ve used MRTG for many years to keep track of network and disk usage on various platoforms. I like it because it’s easy to set up and doesn’t require a database to be configured or maintained. The simple file structure and image creation means that I can easily have the images synchronized to a central web server even if they are generated on the remote device.
The weekly or monthly views of the disk usage are what I find most useful for recognizing trends of usage. I noticed that last Friday there was a huge jump in usage that I ought to spent a little time discovering what suddenly took over a large chunk of my disk.
sudo du --human-readable --max-depth=2 --one-file-system /That command gave me a nice list of where the disk usage was allocated. Here’s a small section of the results that looked suspicious.
20G /var
4.0K /tmp/ssh-72XFLxsn7URe
8.0K /tmp/systemd-private-e26b4caee9b7494e847b16a023d67460-systemd-timesyncd.service-Nuv83g
4.0K /tmp/.Test-unix
8.0K /tmp/systemd-private-e26b4caee9b7494e847b16a023d67460-systemd-logind.service-xl9zMh
88G /tmp/mc-wim
4.0K /tmp/.X11-unix
4.0K /tmp/.font-unix
4.0K /tmp/.ICE-unix
156K /tmp/.qBittorrent
4.0K /tmp/.XIM-unix
88G /tmpThe 88G in a single directory under /tmp looks very much like the size bump I got last Friday, and I remember killing a process via a HUP signal directed at Midnight Commander which was trying to open a very large tar file. Deleting that temporary directory recovered the free space properly.
wim@WimPi4:/tmp $ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 492885032 235012904 237825328 50% /
devtmpfs 1774272 0 1774272 0% /dev
tmpfs 1939136 4 1939132 1% /dev/shm
tmpfs 775656 2088 773568 1% /run
tmpfs 5120 4 5116 1% /run/lock
/dev/mmcblk0p1 258096 50755 207341 20% /boot
tmpfs 387824 0 387824 0% /run/user/1000
tmpfs 387824 0 387824 0% /run/user/1002
tmpfs 387824 0 387824 0% /run/user/1001
wim@WimPi4:/tmp $ rm -r /tmp/mc-wim/
wim@WimPi4:/tmp $ df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 492885032 143584828 329253404 31% /
devtmpfs 1774272 0 1774272 0% /dev
tmpfs 1939136 4 1939132 1% /dev/shm
tmpfs 775656 2088 773568 1% /run
tmpfs 5120 4 5116 1% /run/lock
/dev/mmcblk0p1 258096 50755 207341 20% /boot
tmpfs 387824 0 387824 0% /run/user/1000
tmpfs 387824 0 387824 0% /run/user/1002
tmpfs 387824 0 387824 0% /run/user/1001
wim@WimPi4:/tmp $My MRTG configuration for keeping track of the disk usage on the Raspberry Pi root partition is:
######################################################################
# Disk Monitoring
######################################################################
Options[_]: printrouter, gauge, noo, nolegend, transparent, pngdate
Factor[_]:
kMG[_]: ,k,M,G,T,P
YLegend[_]: Disk Usage
ShortLegend[_]: Bytes
LegendO[_]: Bytes
LegendI[_]: Bytes
Target[wimpi4_disk]: .1.3.6.1.2.1.25.2.3.1.6.31&.1.3.6.1.2.1.25.2.3.1.5.31:public@wimpi4.local * .1.3.6.1.2.1.25.2.3.1.4.31&.1.3.6.1.2.1.25.2.3.1.4.31:public@wimpi4.local
Title[wimpi4_disk]: Disk Usage -- WimPi4
MaxBytes[wimpi4_disk]: 504720539648I got the correct size for MaxBytes by looking at the results from snmpwalk. Multiplying the cluster size (1.3.6.1.2.1.25.2.3.1.4.31) by the number of clusters (1.3.6.1.2.1.25.2.3.1.5.31) gets the total size. If I had multiple disks in the same machine that I wanted to monitor I’d be able to find the human readable name for the disk in this same output.
wim@WimPi4:/tmp $ snmpwalk -Os -c public -v 2c localhost 1.3.6.1.2.1.25.2
iso.3.6.1.2.1.25.2.2.0 = INTEGER: 3878272
iso.3.6.1.2.1.25.2.3.1.1.1 = INTEGER: 1
iso.3.6.1.2.1.25.2.3.1.1.3 = INTEGER: 3
iso.3.6.1.2.1.25.2.3.1.1.6 = INTEGER: 6
iso.3.6.1.2.1.25.2.3.1.1.7 = INTEGER: 7
iso.3.6.1.2.1.25.2.3.1.1.8 = INTEGER: 8
iso.3.6.1.2.1.25.2.3.1.1.10 = INTEGER: 10
iso.3.6.1.2.1.25.2.3.1.1.31 = INTEGER: 31
iso.3.6.1.2.1.25.2.3.1.1.37 = INTEGER: 37
iso.3.6.1.2.1.25.2.3.1.1.39 = INTEGER: 39
iso.3.6.1.2.1.25.2.3.1.1.40 = INTEGER: 40
iso.3.6.1.2.1.25.2.3.1.1.66 = INTEGER: 66
iso.3.6.1.2.1.25.2.3.1.1.67 = INTEGER: 67
iso.3.6.1.2.1.25.2.3.1.1.68 = INTEGER: 68
iso.3.6.1.2.1.25.2.3.1.1.72 = INTEGER: 72
iso.3.6.1.2.1.25.2.3.1.2.1 = OID: iso.3.6.1.2.1.25.2.1.2
iso.3.6.1.2.1.25.2.3.1.2.3 = OID: iso.3.6.1.2.1.25.2.1.3
iso.3.6.1.2.1.25.2.3.1.2.6 = OID: iso.3.6.1.2.1.25.2.1.1
iso.3.6.1.2.1.25.2.3.1.2.7 = OID: iso.3.6.1.2.1.25.2.1.1
iso.3.6.1.2.1.25.2.3.1.2.8 = OID: iso.3.6.1.2.1.25.2.1.1
iso.3.6.1.2.1.25.2.3.1.2.10 = OID: iso.3.6.1.2.1.25.2.1.3
iso.3.6.1.2.1.25.2.3.1.2.31 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.37 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.39 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.40 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.66 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.67 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.68 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.2.72 = OID: iso.3.6.1.2.1.25.2.1.4
iso.3.6.1.2.1.25.2.3.1.3.1 = STRING: "Physical memory"
iso.3.6.1.2.1.25.2.3.1.3.3 = STRING: "Virtual memory"
iso.3.6.1.2.1.25.2.3.1.3.6 = STRING: "Memory buffers"
iso.3.6.1.2.1.25.2.3.1.3.7 = STRING: "Cached memory"
iso.3.6.1.2.1.25.2.3.1.3.8 = STRING: "Shared memory"
iso.3.6.1.2.1.25.2.3.1.3.10 = STRING: "Swap space"
iso.3.6.1.2.1.25.2.3.1.3.31 = STRING: "/"
iso.3.6.1.2.1.25.2.3.1.3.37 = STRING: "/dev/shm"
iso.3.6.1.2.1.25.2.3.1.3.39 = STRING: "/run"
iso.3.6.1.2.1.25.2.3.1.3.40 = STRING: "/run/lock"
iso.3.6.1.2.1.25.2.3.1.3.66 = STRING: "/boot"
iso.3.6.1.2.1.25.2.3.1.3.67 = STRING: "/run/user/1000"
iso.3.6.1.2.1.25.2.3.1.3.68 = STRING: "/run/user/1001"
iso.3.6.1.2.1.25.2.3.1.3.72 = STRING: "/run/user/1002"
iso.3.6.1.2.1.25.2.3.1.4.1 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.3 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.6 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.7 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.8 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.10 = INTEGER: 1024
iso.3.6.1.2.1.25.2.3.1.4.31 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.37 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.39 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.40 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.66 = INTEGER: 512
iso.3.6.1.2.1.25.2.3.1.4.67 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.68 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.4.72 = INTEGER: 4096
iso.3.6.1.2.1.25.2.3.1.5.1 = INTEGER: 3878272
iso.3.6.1.2.1.25.2.3.1.5.3 = INTEGER: 3980668
iso.3.6.1.2.1.25.2.3.1.5.6 = INTEGER: 3878272
iso.3.6.1.2.1.25.2.3.1.5.7 = INTEGER: 2630604
iso.3.6.1.2.1.25.2.3.1.5.8 = INTEGER: 9624
iso.3.6.1.2.1.25.2.3.1.5.10 = INTEGER: 102396
iso.3.6.1.2.1.25.2.3.1.5.31 = INTEGER: 123221258
iso.3.6.1.2.1.25.2.3.1.5.37 = INTEGER: 484784
iso.3.6.1.2.1.25.2.3.1.5.39 = INTEGER: 193914
iso.3.6.1.2.1.25.2.3.1.5.40 = INTEGER: 1280
iso.3.6.1.2.1.25.2.3.1.5.66 = INTEGER: 516191
iso.3.6.1.2.1.25.2.3.1.5.67 = INTEGER: 96956
iso.3.6.1.2.1.25.2.3.1.5.68 = INTEGER: 96956
iso.3.6.1.2.1.25.2.3.1.5.72 = INTEGER: 96956
iso.3.6.1.2.1.25.2.3.1.6.1 = INTEGER: 3712960
iso.3.6.1.2.1.25.2.3.1.6.3 = INTEGER: 3815356
iso.3.6.1.2.1.25.2.3.1.6.6 = INTEGER: 15900
iso.3.6.1.2.1.25.2.3.1.6.7 = INTEGER: 2630604
iso.3.6.1.2.1.25.2.3.1.6.8 = INTEGER: 9624
iso.3.6.1.2.1.25.2.3.1.6.10 = INTEGER: 102396
iso.3.6.1.2.1.25.2.3.1.6.31 = INTEGER: 35973379
iso.3.6.1.2.1.25.2.3.1.6.37 = INTEGER: 1
iso.3.6.1.2.1.25.2.3.1.6.39 = INTEGER: 592
iso.3.6.1.2.1.25.2.3.1.6.40 = INTEGER: 1
iso.3.6.1.2.1.25.2.3.1.6.66 = INTEGER: 101509
iso.3.6.1.2.1.25.2.3.1.6.67 = INTEGER: 0
iso.3.6.1.2.1.25.2.3.1.6.68 = INTEGER: 0
iso.3.6.1.2.1.25.2.3.1.6.72 = INTEGER: 0
wim@WimPi4:/tmp $
WimsWorld 