I'm trying to think of a good way to figure out where space is going on somewhat large and busy filesystems. Often I will be notified by nagios that I am running out of space somewhere, and it will even tell me what the trend in usage is. So now I know that I lost a bunch of space recently. There are several things I can do at that point: - Check quota usage. If quotas are working correctly, this can sometimes help when one user is obviously using a ton of space. More often than not, there is nothing obvious, quotas aren't working or the space is used by system accounts that provide no help in knowing where the space went. - Use du. This is just plain painful and time consuming. Doing this usually causes too much load. Without knowing other ways to find information, I was thinking it would be really nice to have a way to see which files or directories grew or shrank since some point in the past. Would it be possible to get the kernel to tell me when files were opened for writing and closed so I could record the size difference? I know there are various file notify mechanisms, but from what I can see, they don't handle millions of files very well. Of course I'm open to other ideas, but this was my curiosity.