I figured it out.
Apparently some Oracle dbf files were created under a new directory that was one level below a mount point:
ie
![Smilie Smilie](https://www.unix.com/images/smilies/smile.gif)
/u01/arc/server1
/u01/arc/server2
where server1 is it's own mounted filesystem so they created a directory called server2 but it's not mounted so it created it under /.
This slowly filled up / as data was written to the db.
My du -ak * | sort -nr command eventually led to the discovery, I just needed to sift through all of the output to find it.
Thanks to all who assisted.