#!/usr/bin/perl

$avgfile = "/usr/local/lib/duwatch.avg";
$root = "/";
$thresh = 20000;
$period = 30;

open AVG, $avgfile || die;
while (<AVG>) {
	($size, $name) = split;
	$avgdu{$name} = $size;
	$all{$name} = 1;
}
close AVG;

open NEW, "/bin/du -t hfs $root |" || die;
while (<NEW>) {
	($size, $name) = split;
	$size /= 2;	# du reports 512 byte blocks :-(
	if ($size < $thresh) {next};
	$newdu{$name} = $size;
	$all{$name} = 1;
}
close NEW;

for $i (keys %all) {
	if ($newdu{"$i"} > 2 * ($avgdu{"$i"})) {
		printf "%s: %d -> %d\n", $i, $avgdu{$i}, $newdu{$i};
	}
	$avgdu{$i} = ($avgdu{$i} * ($period - 1) + $newdu{$i}) / $period;
}

open AVG, ">" . $avgfile || die;
for $i (keys %avgdu) {
	printf AVG "%d %s\n", $avgdu{$i}, $i;
}
close AVG;