On a UNIX system that is quickly running out of space (MacOS, GNU/Linux) - what is fastest way to find which process and FS path is responsible?

This is a scenario that I experienced both on MacOS and GNU/Linux - a rogue process starts eating disk space. Very fast. You can see with iostat massive writes, with df -h that percents of free space are lower and lower, in few minutes 100% of disk will be full.

What's the quickest way to figure out which process is doing that and where on the disk is the growing blob of used disk space?

On GNU/Linux I would probably go for lsof but that usually takes a lot of time to process, maybe it would be faster to traverse /proc and look for fd folders for each process and check which one is growing fastest? Is there any good userspace tool for this?

How about MacOS is there anything that can be done?

Solution 1:

Keep Activity Monitor open, on a separate Space, so you can quickly flick over to it if something goes runaway.

Use the Disk tab set to sort by Bytes Written. In the View menu set to 'All Processes'.

If something is runaway, you'll quickly see it rising to the top of that page. As the monitoring was already running, there's nothing to launch that you have to wait to finish processing.

This won't tell you where, but it should tell you what, and you can kill it right from that page if you need to.