It’s always either /var/log, or my personal favorite some process spamming tiny files running the disk out of inodes.