One of our users is about to exceed their quota of 20GB. After receiving permission, I logged in to their account and looked around. I see many website files and such, but am not able to find out what's taking up so much space in their account.

Facts:
- This has been a problem for them since they've run cpmove
- This user has reseller permission but no sub-accounts, so it doesn't look like cPanel's counting their user's quota as theirs
- The server has not been compromised by any means

RHEL5 + cPanel 11.18.6

Any ideas are appreciated.

If they receive a lot of email (or a few with large attachments) and use a web based email client such as squirrel mail, it is very possible to eat up disk space. Folks delete mail via squirrelmail but that simply moves it to a trash box. The mail and its attachments remain on the server eating up space. I'd look into mail to at least eliminate it as the cause.

Hmmm, the email accounts aren't using much space: 1GB combined.

How are you determining that?

By looking in their cPanel. They even manually deleted and recreated each email account!

Isnt it possible to use ls or some other command to see what all files are owned by a given user?

du -h --max-depth=1 /home/<username>/mail

Ahem! Like I said, it's not a matter of email accounts taking up the space.

I queried that. All of the accounts combined = 2.3GB. The account is using 22GB total.

Well my last suggestion was not mail specific it was server wide.

That's what was on my mind first too... an archive somewhere or something that had incorrect ownership by the userid of the account. A half a decade ago I vaguely remember having an issue where I restored a backup but somehow didn't preserve ownership/permissions and then to my surprise found a web account owned by a system user because of the different userid mapping. It was before I started using cpanel though, but made me think of looking at something like this.