问题描述：发现Linux的/目录空间报警，然后登录到服务器上通过df -h 查看到/空间的可用在不断的减少，肯定是有文件在不断的占用空间。
排查脚本：查询大于1M的当日改变的文件
[oracle@swnode2 app]$ du -sh `find ./ -mtime 0` | grep [0-9]M | sort -rn
977M ./oracle/admin/gnnt/adump 959M ./grid/diag/tnslsnr/swnode2/asmnet1lsnr_asm/alert 659M ./grid/crsdata/swnode2/acfs 531M ./grid/diag/tnslsnr/swnode2/asmnet1lsnr_asm/trace/asmnet1lsnr_asm.log 498M ./oracle/diag/rdbms/gnnt/gnnt2/trace 297M ./grid/diag/apx/+apx/+APX2/trace 275M ./grid/diag/asm/+asm/+ASM2/trace 163M ./grid/diagsnap/swnode2 162M ./grid/crsdata/swnode2/cvu/cvutrc 144M ./oracle/admin/gnnt/adump/6900B0297CC66549E053650DA8C0B038 97M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace 92M ./12.2.0/grid/crf/db/swnode2/proc 51M ./grid/diag/crs/swnode2/crs/trace/ocssd_76.trc 36M ./grid/diag/tnslsnr/swnode2/listener/trace/listener.log 33M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_mmon_27452.trc 32M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_gen0_27237.trc 32M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/-MGMTDB_mmon_42907.trc 32M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/-MGMTDB_gen0_42706.trc 30M ./grid/diag/tnslsnr/swnode2/listener_scan1/trace/listener_scan1.log 29M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_gen0_7361.trc 28M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_mmon_7475.trc 28M ./grid/diag/apx/+apx/+APX2/trace/+APX2_gen0_7836.trc 26M ./grid/diag/crs/swnode2/crs/trace/osysmond_13.trc 26M ./grid/crsdata/swnode2/cvu/cvutrc/cvutrace.log.3 26M ./grid/crsdata/swnode2/cvu/cvutrc/cvutrace.log.2 26M ./grid/crsdata/swnode2/cvu/cvutrc/cvutrace.log.1 24M ./grid/diag/crs/swnode2/crs/trace/crsd_oraagent_grid.trc 23M ./grid/crsdata/swnode2/cvu/cvutrc/cvuhelper.log.0 22M ./grid/diag/crs/swnode2/crs/trace/ohasd_oraagent_grid.trc 22M ./grid/diag/crs/swnode2/crs/trace/gpnpd.trc 22M ./grid/diag/crs/swnode2/crs/trace/gipcd.trc 20M ./grid/crsdata/swnode2/cvu/cvulog 19M ./grid/diag/clients/user_grid/host_4152456498_107/trace 18M ./grid/diag/crs/swnode2/crs/trace/ohasd_orarootagent_root.trc 16M ./grid/diag/crs/swnode2/crs/trace/crsd_scriptagent_grid.trc 16M ./grid/crsdata/swnode2/acfs/acfs.log.0 15M ./grid/diag/tnslsnr/swnode2/mgmtlsnr/trace/mgmtlsnr.log 15M ./grid/diag/crs/swnode2/crs/trace/octssd.trc 15M ./grid/crsdata/swnode2/cvu/cvutrc/cvutrace.log.0 14M ./oracle/diag/rdbms/gnnt/gnnt2/incident 12M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_lmhb_27353.trc 12M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_dia0_27310_base_1.trc 12M ./grid/diag/crs/swnode2/crs/trace/ologgerd.trc 12M ./grid/crsdata/swnode2/acfs/advm.bin.12 11M ./grid/diag/tnslsnr/swnode2/asmnet1lsnr_asm/alert/log_95.xml 11M ./grid/diag/crs/swnode2/crs/trace/ohasd.trc 11M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_lmhb_7425.trc 11M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l01 10M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l08 10M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l07 10M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l04 10M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l03 10M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l02 9.9M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l09 9.9M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l06 9.9M ./12.2.0/grid/crf/db/swnode2/proc/procdump.l05 9.8M ./12.2.0/grid/rdbms/audit/+ASM2_ora_51680_20180705000128420057143795.aud 9.7M ./oracle/diag/rdbms/gnnt/gnnt2/incident/incdir_2520377 9.7M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/alert/log.xml 9.6M ./grid/diag/crs/swnode2/crs/trace/ocssd.trc 9.4M ./grid/diag/tnslsnr/swnode2/listener_scan1/alert/log.xml 9.4M ./grid/diag/crs/swnode2/crs/trace/osysmond.trc 8.6M ./oracle/diag/rdbms/gnnt/gnnt2/incident/incdir_2520377/gnnt2_mmon_27452_i2520377.trc 8.3M ./grid/diag/tnslsnr/swnode2/listener/alert/log.xml 8.1M ./grid/diagsnap/swnode2/diagsnap_swnode2.log 7.9M ./grid/crsdata/swnode2/qos/logs 7.5M ./grid/diag/crs/swnode2/crs/trace/ocssd_76.trm 7.3M ./12.2.0/grid/rdbms/audit/+ASM2_ora_51680_20180705152908123581143795.aud 6.9M ./oracle/admin/gnnt/adump/gnnt2_ora_19062_20180705235537335003143795.aud 6.7M ./12.2.0/grid/srvm/admin 6.6M ./grid/diag/tnslsnr/swnode2/asmnet1lsnr_asm/alert/log.xml 5.7M ./grid/diag/crs/swnode2/crs/trace/ohasd_cssdmonitor_root.trc 5.6M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_mmon_27452.trm 5.6M ./grid/diag/crs/swnode2/crs/trace/crsd.trc 5.5M ./grid/diag/crs/swnode2/crs/trace/ohasd_oraagent_grid.trm 5.1M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/incident 5.0M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/incident/incdir_48265 4.8M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_gen0_27237.trm 4.7M ./12.2.0/grid/log/swnode2/client 4.6M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/incident/incdir_48265/-MGMTDB_mmon_42907_i48265.trc 4.6M ./grid/diag/crs/swnode2/crs/trace/crsd_orarootagent_root.trc 4.5M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_dia0_27310_base_1.trm 4.4M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_dbrm_27277.trc 4.4M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/-MGMTDB_dbrm_42768.trc 4.4M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_gen0_7361.trm 4.3M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/-MGMTDB_mmon_42907.trm 4.3M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/-MGMTDB_gen0_42706.trm 4.3M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_mmon_7475.trm 4.3M ./grid/diag/apx/+apx/+APX2/trace/+APX2_gen0_7836.trm 4.2M ./grid/diag/crs/swnode2/crs/trace/ohasd_cssdagent_root.trc 3.9M ./grid/diag/crs/swnode2/crs/trace/crsd_oraagent_grid.trm 3.8M ./oracle/diag/rdbms/gnnt/gnnt2/trace/alert_gnnt2.log 3.6M ./oracle/product/12.2.0/db_1/cfgtoollogs/opatch 3.6M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/trace/alert_-MGMTDB.log 3.6M ./grid/diag/crs/swnode2/crs/trace/crsd_jagent_grid.trc 3.5M ./grid/diag/asm/+asm/+ASM2/alert/log.xml 3.4M ./grid/diag/crs/swnode2/crs/trace/crsd_scriptagent_grid.trm 3.4M ./12.2.0/grid/cfgtoollogs/opatch 3.2M ./oracle/diag/rdbms/gnnt/gnnt2/alert/log.xml 3.2M ./grid/diag/crs/swnode2/crs/trace/gipcd.trm 3.1M ./oracle/admin/gnnt/adump/gnnt2_ora_15879_20180706030706129797143795.aud 3.1M ./grid/diag/crs/swnode2/crs/trace/ohasd_orarootagent_root.trm 2.9M ./oracle/admin/gnnt/adump/gnnt2_j002_24048_20180705220024598306143795.aud 2.8M ./grid/diag/crs/swnode2/crs/trace/octssd.trm 2.8M ./grid/diag/crs/swnode2/crs/trace/crsd_oraagent_oracle.trc 2.7M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_lms0_27326.trc 2.7M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_dia0_27310_lws_1.trc 2.6M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_lms1_27328.trc 2.6M ./grid/crsdata/swnode2/trace/chad/ochad.trc.0 2.5M ./12.2.0/grid/crf/db/swnode2/proc/procdump.log 2.4M ./grid/diag/crs/swnode2/crs/trace/gpnpd.trm 2.4M ./grid/crsdata/swnode2/evm 2.1M ./oracle/diag/rdbms/gnnt/gnnt2/metadata/DFW_PURGE_ITEM.ams 2.1M ./oracle/admin/gnnt/adump/gnnt2_ora_34857_20180705221902514272143795.aud 2.1M ./grid/diag/crs/swnode2/crs/trace/ologgerd.trm 2.1M ./grid/diag/crs/swnode2/crs/trace/ohasd.trm 2.1M ./grid/diag/crs/swnode2/crs/metadata/DFW_PURGE_ITEM.ams 2.1M ./grid/diag/asmtool/user_grid/host_4152456498_107/alert/log.xml 2.1M ./grid/crsdata/@global/cvu/baseline/cvures 1.9M ./grid/diagsnap/swnode2/evt_1_20180706-025941 1.9M ./12.2.0/grid/rdbms/audit/+ASM2_ora_45011_20180630235220082856143795.aud 1.8M ./grid/diag/crs/swnode2/crs/trace/evmd.trc 1.8M ./12.2.0/grid/rdbms/audit/+ASM2_ora_13846_20180706030604564198143795.aud 1.7M ./oracle/product/12.2.0/db_1/cfgtoollogs/opatch/lsinv 1.7M ./oracle/admin/gnnt/adump/gnnt2_ora_19670_20180705235607678244143795.aud 1.6M ./12.2.0/grid/cfgtoollogs/opatch/lsinv 1.5M ./grid/diag/asm/user_grid/host_4152456498_107/alert/log.xml 1.5M ./12.2.0/grid/rdbms/log 1.5M ./12.2.0/grid/cdata/swnode2.olr 1.4M ./grid/diag/crs/swnode2/crs/trace/ocssd.trm 1.3M ./grid/diag/rdbms/_mgmtdb/-MGMTDB/metadata/DFW_PURGE_ITEM.ams 1.2M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_mmon_9212.trc 1.2M ./grid/diag/crs/swnode2/crs/trace/ohasd_cssdmonitor_root.trm 1.1M ./oracle/diag/rdbms/gnnt/gnnt2/trace/gnnt2_gen0_9004.trc 1.1M ./oracle/diag/rdbms/gnnt/gnnt2/incident/incdir_2520377/gnnt2_mmon_27452_i2520377.trm 1.1M ./grid/diag/tnslsnr/swnode2/mgmtlsnr/alert/log.xml 1.1M ./grid/diag/crs/swnode2/crs/trace/crsd.trm 1.1M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_lms0_7415.trc 1.1M ./12.2.0/grid/rdbms/audit/+ASM2_ora_62301_20180705155542656414143795.aud 1.1M ./12.2.0/grid/rdbms/audit/+ASM2_ora_40722_20180705195554780511143795.aud 1.1M ./12.2.0/grid/rdbms/audit/+ASM2_ora_19404_20180705235600641745143795.aud 1.1M ./12.2.0/grid/rdbms/audit/+ASM2_ora_17214_20180705115536941463143795.aud 1.0M ./grid/diag/asm/+asm/+ASM2/trace/+ASM2_gen0_7782.trc