Originally Posted by Unknown_User
Use the find command;
# find / -type f -size +20000k
(Change the +20000k to whatever size you want to look for.)
OP didn't specify distro.
I have in the past seen postfix malfunction and send emails to root reporting the malfunction (which were kept in the queue because postfix was malfunctioning). One of these came out every 60 seconds and over a period of time filled the HD with a couple of million messages which remained queued.
The point of this? Use find to establish the status of not merely files but directories too:
find / -type d -size +20k
will pick these up and could identify the problem.