A client’s Macbook pro HD was filling up faster than he could find things to delete.
The OS was dumping core files to the hidden /cores directory. The files were close to 700 MB each, and the system was creating about one a minute, eating up all his space in very short order.
Turns out, an old 2015 version of Trend Micro Antivirus was (unintentionally) still on the machine, and that software was causing the system crashes which generated the dump files. Removing that software solved the problem.
To find the problem was trickier.
First, to even find which files were being created, I used omnidisksweeper. It showed the cores folder being the culprit.
Next, I had to give the user account permission to read/write one of the core dump files (by highlighting the file / get info / security and permissions / add the user / change to read/write).
Next, open terminal and opened the dump file to run a backtrace.
lldb -c /cores/core.XXXX (where XXXX was one of the numbers in one of the core dump files)
Then, from within lldb, used
bt all
to show the backtrace code.
A line in there gave me a hint. From there, I went to the Console and watched for errors thrown there, too. Sure enough, an error was being thrown more than every minute. That error listed a file that I was able to Google, and find was related to Trend Micro.
I hope this helps someone else. It was a fun puzzle.