It filled at around: 07/Nov/2017:19:41:03 and emptied at: 08/Nov/2017:04:05:05.
The closest cronjob was at 04:05:50, a postfix & dovecot restart.
I know these from other services logs, the root drives were so full even logging stopped at that point.
I'm using debian 9, with the following services running:
[ + ] acpid [ + ] ajenti [ + ] apache-htcacheclean [ + ] apache2 [ + ] atd [ + ] avahi-daemon [ + ] cron [ + ] dbus [ + ] dovecot [ + ] fail2ban [ + ] irqbalance [ + ] kmod [ + ] memcached [ + ] minissdpd [ + ] munin-node [ + ] mysql [ + ] networking [ + ] ntp [ + ] postfix [ + ] procps [ + ] rc.local [ + ] rpcbind [ + ] rsyslog [ + ] smartmontools [ + ] ssh [ + ] stunnel4 [ + ] udev [ + ] unattended-upgrades [ + ] urandom
My question is, how could I track down what caused this strange disk fillup ( & emptying ) ? And if not, can i prevent it somehow?