17 Dec
2011
17 Dec
'11
5:05 p.m.
What with snapshots and the filesystem trickery that makes them possible, it may help to temporarily forget about the ongoing deletions and focus on the space consumption. It can be hard to identify who is writing; besides filehandles held open for long-term writing, kernels can write seemingly on their own initiative for core dumps and the like.
Sometimes it helps to ogle raw ip traffic to look for hosts sending lots of traffic to an address owned by a filer.