[CentOS] What is writing to my filesystem

From: "JCARRIZOSA at Crutchfield.com" <JCARRIZOSA at Crutchfield.com>
> I have a CentOS 5.2 box that every few months runs out of drivespace on
> its root filesystem. Last time I manually searched and deleted some big
> files, but don't remember what they were or what wrote to them. The
> applications I'm aware of on the box don't write to /. 
> Is there a way to find the files that get written to the most, or grow
> the most over time? Doing a df gives me a snapshot, but it seems clunky
> to keep track of the diff on that output over time. I can then see what
> processes write to them. Any other ideas on how to investigate this are
> welcome.

Do you use logrotate?
Do you use logrotate's compression?

Maybe use some kind of snapshots, like:

#!/bin/bash
find /var -type f -printf "%k %p\n" > /tmp/usedspace.new
if [ -f /tmp/usedspace.old ]; then
  cat /tmp/usedspace.old | while read LINE
    do
      set $LINE
      OLDSIZE=$1
      OLDFILE=$2
      NEWSIZE=`grep "$OLDFILE\$" /tmp/usedspace.new | cut -d " " -f1`
      if [ -n "$NEWSIZE" -a "$OLDSIZE" != "$NEWSIZE" ]; then
        echo "$OLDFILE: $OLDSIZE => $NEWSIZE"
      fi
    done
fi
mv -f /tmp/usedspace.new /tmp/usedspace.old

JD