What is filling up my hard drive so fast?

You don't need special software (although there are nice options like What Size and the also-popular Daisy Disk) or to run commands in terminal to track 4 GB of change.

Apple's System Information app draws the About This Mac information that you get from Apple Menu -> About This Mac -> Storage Tab (at the top).

Storage

Click Manage for more details.

Recommendations view

Click Review Files if the higher priority recommendations don't work or are not palatable to your use case.

sorted list of large documents that aren't used often or may be deleted

Then you can know what files and buckets are the largest users of space and/or notice which buckets grow over time.

Additionally, Time Machine is very nice for telling you what files have changed if you use that tool for your backups. It would know exactly what time interval new files grew and changed since you can use a tool like BackupLoupe (or tmutil compare if you do like command line tools) to visually inspect the difference between two backup intervals to see what files used more space on your Mac.

enter image description here

A very low level tool to see actual writes is fs_usage but it's a bit technical and you'll need to know|learn grep or awk to reduce the output of this tool

sudo fs_usage -w

To quit the activity dump, press control C


Here's the systematic way to find where the disk space went: Open a window in Terminal (you find this under Utilities), then type:

cd /
sudo du -sm *

This will give you the disk consumption, in megabytes, of every top level entry in the folder hierarchy.

You could then drill down further, but without a good idea of what things do, you might easily decide on a wrong culprit (in particular, don't go around deleting random files in /System; that is bound to end in tears).

However, since your system keeps filling up by itself, you can just let it sit for an hour, and then run the du command above again. The difference between the two sets of numbers will show you where the space went.

In particular, if logging is a problem, you might see the number for /private go up.