Puppy Linux Discussion Forum

FatDog64 ships with Graphical Disk Map 0.8.1. "Files are displayed in a cushioned tree map."

Are there alternative tools available, both command line and GUI based, that allow you to analyze disk space usage in more detail and with filter options (tree style rather than visual map)?

I am looking specifically for a way to find the most recent file changes of the system; i.e. which data exactly has been added recently to the system that occupies X amount of RAM.

Neo_78 wrote: ↑Sat Feb 12, 2022 10:41 pm

FatDog64 ships with Graphical Disk Map 0.8.1. "Files are displayed in a cushioned tree map."

Are there alternative tools available, both command line and GUI based, that allow you to analyze disk space usage in more detail and with filter options (tree style rather than visual map)?

Check ncdu (CLI utility, already in FD) and Large Files Finder: https://oldforum.puppylinux.com/viewtopic.php?t=77779.

I am looking specifically for a way to find the most recent file changes of the system; i.e. which data exactly has been added recently to the system that occupies X amount of RAM.

That should be doable with pFind (right-click a folder -> Search with pFind).

Greetings!

Neo_78 wrote: ↑Sat Feb 12, 2022 10:41 pm

Are there alternative tools available, both command line and GUI based, that allow you to analyze disk space usage in more detail and with filter options (tree style rather than visual map)?

I am looking specifically for a way to find the most recent file changes of the system; i.e. which data exactly has been added recently to the system that occupies X amount of RAM.

Other alternatives are rox's own find function (see the quick help below). Right-click a folder icon in rox, select Next click then select Find at the bottom of the menu list.

Cli-based you could use find (manual page). To navigate find's output in a tree-like style in your terminal you could pipe find into ictree (project page; source code).

rox find quick help, e.g. "mtime after 1 day ago and size > 1Mb (big, and recently modified)"

Quick Start
Just put the name of the file you're looking for in single quotes:
'index.html' (to find a file called 'index.html')

Examples
'*.htm', '*.html' (finds HTML files)
IsDir 'lib' (finds directories called 'lib')
IsReg 'core' (finds a regular file called 'core')
! (IsDir, IsReg) (is neither a directory nor a regular file)
mtime after 1 day ago and size > 1Mb (big, and recently modified)
'CVS' prune, isreg (a regular file not in CVS)
IsReg system(grep -q fred "%") (contains the word 'fred')

Simple Tests
IsReg, IsLink, IsDir, IsChar, IsBlock, IsDev, IsPipe, IsSocket, IsDoor (types)
IsSUID, IsSGID, IsSticky, IsReadable, IsWriteable, IsExecutable (permissions)
IsEmpty, IsMine
A pattern in single quotes is a shell-style wildcard pattern to match. If it
contains a slash then the match is against the full path; otherwise it is
against the leafname only.

Comparisons
<, <=, =, !=, >, >=, After, Before (compare two values)
5 bytes, 1Kb, 2Mb, 3Gb (file sizes)
2 secs|mins|hours|days|weeks|years ago|hence (times)
atime, ctime, mtime, now, size, inode, nlinks, uid, gid, blocks (values)

Specials
system(command) (true if 'command' returns with a zero exit status;
a % in 'command' is replaced with the path of the current file)
prune (false, and prevents searching the contents of a directory).

Neo_78 wrote: ↑Sat Feb 12, 2022 10:41 pm

I am looking specifically for a way to find the most recent file changes of the system

Shouldn't be a problem (see above proposals).

; i.e. which data exactly has been added recently to the system that occupies X amount of RAM.

That looks close to impossible to me, unless you clarify what you mean by "data added to the system".
If you mean files "added" you may not find them when you search for "modified" time (time of copy/move is recorded as "changed" time, "birth" time of newly added files is normally not recorded at all). And the mtime only tells you that the file was modified, not if and by what amount the file size increased/decreased.

Maybe this can help: On my system the directory /initrd/pup_rw holds the files added/changed since boot. These files occupy RAM. You could use the tool of your choice to analyze them. Don't know if this applies to Fatdog.

@MochiMoppel GDM has a little indicator of free RAM space in the bottom panel. Once FatDog is loaded into RAM, it indicates 3.1GB of free space. During normal day operation this sometimes drops to 3.0GB although I do not open additional programs or download anything. So I would like to know what exactly occupies those 100MB.

Neo_78 wrote: ↑Mon Feb 14, 2022 2:10 pm

GDM has a little indicator of free RAM space in the bottom panel.

Technically, it's not GDM's indicator, it's freemem.sh script, which invokes GDM on right-click, but that's a detail.

Once FatDog is loaded into RAM, it indicates 3.1GB of free space. During normal day operation this sometimes drops to 3.0GB although I do not open additional programs or download anything. So I would like to know what exactly occupies those 100MB.

A possible explanation is that some processes cache things in tmpfs in an unlinked form.
For example, opening a YT video in FF causes a part of that video to be cached in /tmp and immediately unlinked, so you won't find these files in /tmp and yet you can see that the space is used:

# df -h /tmp
Filesystem      Size  Used Avail Use% Mounted on
tmpfs           2.7G   66M  2.6G   3% /tmp

We have 66M used, but the size of all files inside /tmp is only:

# du -ch /tmp | grep total
1.1M	total

You can find those unlinked files in /tmp by doing this (I have 2 tabs with videos open):

# lsof +L1 | grep /tmp
Isolated    789 spot   34u   REG   0,25 22151168     0      78 /tmp/mozilla-temp-1156782472 (deleted)
gtkdialog  2149 root   10u   REG   0,25    47056     0     122 /tmp/vteIGMJH1 (deleted)
gtkdialog  2149 root   11u   REG   0,25    69642     0     123 /tmp/vteJJMJH1 (deleted)
gtkdialog  2149 root   12u   REG   0,25    16592     0     124 /tmp/vte7JMJH1 (deleted)
tilda      2157 root   11u   REG   0,25    23184     0     201 /tmp/vteUYCSH1 (deleted)
tilda      2157 root   12u   REG   0,25    44332     0     202 /tmp/vteSUESH1 (deleted)
tilda      2157 root   13u   REG   0,25     5968     0     203 /tmp/vteXVESH1 (deleted)
Isolated  10379 spot   34u   REG   0,25 45350912     0     191 /tmp/mozilla-temp-2080028079 (deleted)

Now let's add up the sizes:

# echo '(22151168 + 47056 + 69642 + 16592 + 23184 + 44332 + 5968 + 45350912) / 1024 / 1024' | bc -l
64.57219505310058593750

~64.6M (lsof) + 1.1M (du) = 65.7M ≈ 66M (df)

Similar thing may happen in /dev/shm, btw.

MochiMoppel wrote: ↑Mon Feb 14, 2022 3:54 am

Maybe this can help: On my system the directory /initrd/pup_rw holds the files added/changed since boot. These files occupy RAM. You could use the tool of your choice to analyze them. Don't know if this applies to Fatdog.

In Fatdog it's /aufs/pup_rw.

Greetings!

Wouldn't it be possible to set up a filter with tcpdump that writes to a log file and monitors the IPs of incoming traffic packets that are larger than 50 MB? For instance tcpdump -i eth0 inbound greater 50000 -w log.txt

In this way the source IPs could be analyzed to determine if this is normal traffic or malicious activity that causes the ram size change.