Hi All, Thanks to Eneko Lacunza, E Taka, and Anthony D'Atri for replying - all that advice was really helpful. So, we finally tracked down our "disk eating monster" (sort of). We've got a "runaway" ceph-guest-NN that is filling up its log file (/var/log/ceph/ceph-guest-NN.log) and eventually over-flowing the /var partition. What we haven't been able to do yet is actually track-down the "ceph-guest-NN" process so we can kill it. Restarting the monitor service on that node "pauses" the offending process, but as soon the mon service restarts the relevant log file is re-created/begins to fill up again. What we've done in the mean time is put cron job in place to run once a day to delete the offending log file - that's keeping us online, but it's a less-than-optimal solution (ie it's a "hack"). Soooooo... anyone got any pointers as to how we can go about actually finding the offending process? Cheers Dulux-Oz