Tracing file size changes

[Chris]

I'm trying to think of a good way to figure out where space is going on
somewhat large and busy filesystems.  Often I will be notified by nagios that I
am running out of space somewhere, and it will even tell me what the trend in
usage is.  So now I know that I lost a bunch of space recently.

There are several things I can do at that point:
- Check quota usage.  If quotas are working correctly, this can sometimes
help when one user is obviously using a ton of space.  More often than not,
there is nothing obvious, quotas aren't working or the space is used by system
accounts that provide no help in knowing where the space went.
- Use du.  This is just plain painful and time consuming.  Doing this usually
causes too much load.

Without knowing other ways to find information, I was thinking it would be
really nice to have a way to see which files or directories grew or shrank
since some point in the past.  Would it be possible to get the kernel to tell
me when files were opened for writing and closed so I could record the size
difference?  I know there are various file notify mechanisms, but from what I
can see, they don't handle millions of files very well.

Of course I'm open to other ideas, but this was my curiosity.