I already tried things like
sudo du -csh * (in the root dir),
sudo find /usr/lib/ -type f -printf "%s\t%p\n" | sort -n | tail -10
sudo du -a / --exclude=/media --exclude=/home | sort -n -r | head -n 100 and similar commands. I'm looking for something that is about recent disk space use and that works reliably (even in my use-case).
The problem with these is that because there is "No space left on device" I can't run them - if I free up some disk space (for example by running bleachbit or removing large unnecessary packages or deleting some files in /tmp/) it doesn't take long until that space is taken up as well. I already moved /var/lib/docker which was several GBs in size which were shown to be freed up afterwards - now something must have taken up these GBs worth of disk space.
The second problem is that when I run these commands when I have some free disk space I currently couldn't easily identify which of the files and directories are new and unnecessary. The largest directory seems to be /usr/share.
sudo du -csh /usr/share/* | grep "G" only displays that it's 7GB which shouldn't be too large. An earlier output of
sudo du -ah / --exclude=/media --exclude=/proc --exclude=/home | sort -n -r | head -n 100 which I stored to another partition only shows files of 1 MB sizes (including in /usr/share/).
Is there a good way to nicely and quickly output a list of the largest files and directories which have recently been added, maybe even including processes responsible for that? It would also be useful if one was able to specify another /tmp/ directory for running the command if that's possible. I'm using Debian10/KDE.
A simple and reliable way to list what's recently been taking up disk space would be very handy here.
Update: I was able to show recently modified files in the root directory that are larger than a specified filesize with the preinstalled KFind. I can't exclude directories with it and I can't start veracrypt to unmount a partition because I only get the message "veracrypt is already running". However, I was still able to find the problematic file:
it was /proc/pid/task/pid/fd which was an open instance of the konsole with only one command running where aborting that command did not free up the disk space - I had to close the konsole window with all its tabs and subsequently had several GBs worth of free disk space again.