They had me setup a script + cron job to try and capture information on the datastore. The cron job runs every 5 minutes and outputs to a file. So far the output has not shown us any indications that unknown files are being stored on the datastore or files are expanding/shrinking mysteriously.
#!/bin/bash
guid=${1}
echo ========== BEGIN ============
date
echo '** vmkfstools **'
/usr/sbin/vmkfstools -v 11 -Ph /vmfs/volumes/${guid}/
echo '** ls **'
ls -alRh /vmfs/volumes/${guid}/
echo '** du **'
du -h /vmfs/volumes/${guid}/
echo =========== END =============
echo
Example cron job:
[root ~]# crontab -l
*/5 * * * * /checkLun.bash 500eb009-b0e52168-ea3e-b499baa6452a >>/var/log/500eb009-b0e52168-ea3e-b499baa6452a.log 2>&1
*/5 * * * * /checkLun.bash 500eb045-978a8ccd-db61-b499baa6452a >>/var/log/500eb045-978a8ccd-db61-b499baa6452a.log 2>&1
Are your datastores VMFS 3.33 with 8MB block size? That's how ours are currently configured. But we'll be upgrading to VMFS 5.x soon, so I've been holding out to see if the problem persists after we complete our vSphere 5.1 upgrade.
Another possibly helpful command will show you the current size of files vs. the provisioned size:
[root ~]# ls -lsh
The "-s" switch shows provisioned size. "-h" puts it in human readable format.
This may reveal any non-VM files that have an unusual configuration where provisioned storage is different that storage consumed.
