Which huge data were created at my last Mirroring?

[Digard]

Having used FFS for quite some time, very happily, today I encountered a problem at a new setting:
Both sides are SFTP, both are former thin clients (WYSE 5010) with 8 GB of RAM each, running *buntu 22_4, and 5 TB external drives each for the data. The left side is connected to my controlling laptop, running FFS (*buntu 24_4, lenovo) via WiFi; the right side via the same network (WiFi) to a fibre modem connected through the Internet to the other WYSE at a distance of several thousand km away.

The amazing result is, that despite of the old lenovo laptop and everything WiFi, and the low-end hardware of the actual data server, I manage to synchronize the two sides (419 items, 336 GB) at a an average speed of above 6 MB/s; that is the 336 GB have an ETA of 16 hours. Amazing!

Now my problem: Over the last years the system drive of the receiving, far away end, usually had some 1.2 - 1.5 GB free (minimal install, apt, logrotate and journal tuned). Within the first 15 minutes of use, this time,

/


ran full to 100%!
That is, per the ca. 4 GB transferred, it stored some 1.2 GB. But where? I have tried all the usual places, journal, syslog, tmp, but to no avail. I even tried a reboot, but

/


remains at close to 100%.
I had never experienced anything like this before. And still can't make out, where? And what sort of data?
I am pretty sure that it must be linked to FFS, because the tiny target system didn't do anything else. It had been fully updated half an hour earlier.

apt autoremove && apt clean


had been done, as expected without improvement.

The only thing that I can image as incidence: at the initial deletion of files on the target, FFS had indicated a problem, that no trash was available for the data to be deleted, and asked if I wanted to ignore that. Yes, I wanted that and clicked "Ignore".

My question is, I guess, obvious: which data could have been written within that quarter of an hour, with a size of more than 1 GB, and - most of all - whereto; so that a reboot didn't clear them out, and I couldn't find anything suspicious in the usual, notorious locations.
(Running 14.4).

[xCSxXenon]

You'll need a disk usage analyzer to figure that out

[Digard]

Thanks for the help!

Actually, with the help of duc I found the problem; one has had occurred for me rarely, though already earlier during my last 30 years on *nix.
There is a /foo/bar directory, that is empty and its sole purpose is to have another medium mounted over it, with /foo/bar as mount point.
Once the mount is flimsy, the data are written to the media that originally hosts /foo/bar, instead to the media intended. Once the mount is back again, those data become invisible in the directory view, and bar shows only the the data found on that second medium.

Once the second medium was unmounted, those data became visible yet again, and could be deleted.

(I wonder if there is any method to display for any directory, if it contains data, once another medium is mounted 'over' it?)