root filesystem filling up

HI all
I have an urgent and confusing 1 here - my box is a debian sid. Here is a copy of output of mount:
$ mount
/dev/hda3 on / type ext3 (rw,errors=remount-ro)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
usbfs on /proc/bus/usb type usbfs (rw)
tmpfs on /dev/shm type tmpfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/hdc3 on /var type ext3 (rw)
/dev/sda1 on /home type ext3 (rw)
/dev/sdb1 on /var/local type ext3 (rw)
tmpfs on /dev type tmpfs (rw,size=10M,mode=0755)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
/dev/hdd on /cdrom type iso9660 (ro,noexec,nosuid,nodev,user=glenn)
$
Notice var and home are on volumes other than the root (/dev/hda3)
 
The problem I have is my root filesystem keeps filling up. Easy fixed? Get rid of stuff? ok so I delete 600mb worth of crap from /root, I move 1.7GB from /usr/share/doc /var/local and symbolically link it back, like. There that should fix it!  Come home from work and df tells me /dev/hda3 has 0 avail and 100% use.   Ok - mv /usr/src to /var/local, and remove /root/src where I play with e17 and open emebedded etc - another 2+gb. hours later all my space is gone!

So I wonder if I've been hacked - Im no security expert - but a mate whos name/passwd was tom:tom had people ssh and ftp in and build lists of spam addressed etc, so  I browse log files looking for errant ssh, ftp or telnet (later 2 disabled) connection - nothing.

Ive just purged 220 mb of packaes that I dont use and my current df is:
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda3              35G   33G  141M 100% /
tmpfs                 506M  4.0K  506M   1% /dev/shm
/dev/hdc3             110G   67G   38G  65% /var
/dev/sda1             111G   81G   24G  78% /home
/dev/sdb1             184G  144G   31G  83% /var/local
tmpfs                  10M  204K  9.9M   2% /dev
/dev/hdd               83M   83M     0 100% /cdrom

Know whats interesting - when I started typing this there was  180M available - can anyone help me determine whats filling up my root file system? Is there a utility to tell me what the latest modfied file in the system is?

Id give away 2000 points if i could for this one.... please help me here
Thanks
Glenn

PS

Btw in 2 minutes its taken me to type the last 3 pars, the files systems lost another 10M:
odin:/usr/src# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/hda3              35G   33G  131M 100% /
tmpfs                 506M  4.0K  506M   1% /dev/shm
/dev/hdc3             110G   67G   38G  65% /var
/dev/sda1             111G   81G   24G  78% /home
/dev/sdb1             184G  144G   31G  83% /var/local
tmpfs                  10M  204K  9.9M   2% /dev
/dev/hdd               83M   83M     0 100% /cdrom

Start Free Trial