Manjaro root almost full

Question

I'm using Timeshift tool for backups. So today during backup I've noticed that I have selected /dev/sda3 (mounted as /) for backup and stopped backup process. Timeshift stopped responding and I had to kill the process. After that my root partition is almost full.

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda3        79G   76G  2.3G  98% /
dev             2.7G     0  2.7G   0% /dev
tmpfs           2.7G   14M  2.7G   1% /dev/shm
tmpfs           2.7G     0  2.7G   0% /sys/fs/cgroup
run             2.7G  1.1M  2.7G   1% /run
tmpfs           2.7G  8.0K  2.7G   1% /tmp
/dev/sda5        99G  126M   98G   1% /code
/dev/sda1      1022M   19M 1004M   2% /boot/efi
/dev/sda4       111G  9.3G  101G   9% /home
tmpfs           544M   20K  544M   1% /run/user/1000
$ sudo du -sh /*
0       /bin
88M     /boot
66M     /code
152K    /dev
20M     /etc
9.2G    /home
24K     /kde-image-pkgs.txt
0       /lib
0       /lib64
16K     /lost+found
4.0K    /media
4.0K    /mnt
4.0K    /opt
0       /proc
12M     /root
8.0K    /root-image-pkgs.txt
1.1M    /run
0       /sbin
12K     /srv
0       /sys
8.0K    /tmp
7.2G    /usr
223M    /var

After pacman -Scc +1% available. Also restart to fix "open file deletion" issue didn't work.

Could anyone help me to figure out the reason?

Answer 1

After few hours of investigation and various tools I finally found the solution. Using regular user and root accounts my /var/tmp directory was empty. No /var/tmp files in lsof list, ncdu, du, find etc. So I just mount my /dev/sda3 (root mount point) to other dir (/mnt) and you know what - /mnt/var/tmp contains all temp files created by Timeshift for about 68Gb and ncdu /mnt shows it.

Maybe this could be helpful for someone who will face the same problem.