Jon Haslam's Weblog

Well, I must say that last week was possibly the worst week back from a holiday that I've ever had. Tragedy, chaos and trauma; it had the lot. Still, as my dear, dear old granny says - "Stop whinging, shut your yap and get on with it". So without further yap let's get it on ...

Someone posted a question the other day on an internal alias:- What's the best/cheapest way to monitor the size of a file? Well, there are several possible ways to do this but our boy DTrace gives us the best way in my view. The following D script uses the ufs function wrip() to inform us when a given files size changes.

#!/usr/sbin/dtrace -s

#pragma D option quiet

BEGIN
{
        size = 0;
}

/* wrip does the real work for a ufs write. The first argument is a struct inode* so
  we can extract everything we need (vnode, size) from this */
fbt::wrip:entry
/(self->file = stringof(args[0]->i_vnode->v_path)) == $$1 /
{
        self->inode = args[0];
}

/* If the file in question has changed size tell us */
fbt::wrip:return
/self->inode && size != self->inode->i_ic.ic_lsize/ 
{
        printf("File %s changed size: size = %d\n",
            self->file, self->inode->i_ic.ic_lsize);
        size = self->inode->i_ic.ic_lsize;
        self->inode = 0;
        self->file = 0;
}

fbt::wrip:return
/self->inode && size == self->inode->i_ic.ic_lsize/
{
        self->inode = 0;
        self->file = 0;
}

So, an example run looks like:

# ./file.d /var/tmp/bigfile
File /var/tmp/bigfile changed size: size = 132120576
File /var/tmp/bigfile changed size: size = 133169152
File /var/tmp/bigfile changed size: size = 134217728
File /var/tmp/bigfile changed size: size = 134712950

Marvellous. Yet again showing that the only tool you'll ever need is DTrace (and maybe a potato peeler). The above is only good for ufs but it would be fairly trivial to add other filesystems into this. However, if anybody has a more general purpose solution I'm all ears.