RHEL 5.3 sar -v output continues to show an file-sz increase

Anyone out in the wide world web seen this before;

sar -v

16:50:01    dentunusd   file-sz  inode-sz  super-sz %super-sz  dquot-sz %dquot-sz  rtsig-sz %rtsig-sz
17:00:01        22144      5100     18581         0      0.00         0      0.00         0      0.00
17:10:01        22274      5610     18591         0      0.00         0      0.00         0      0.00
17:20:01        22631      5610     18832         0      0.00         0      0.00         0      0.00
17:30:01        22744      5610     18822         0      0.00         0      0.00         0      0.00
17:40:01        23233      6120     19172         0      0.00         0      0.00         0      0.00
17:50:01        23563      6120     19381         0      0.00         0      0.00         0      0.00
18:00:01        23702      5610     19395         0      0.00         0      0.00         0      0.00
18:10:01        24023      6120     19583         0      0.00         0      0.00         0      0.00
18:20:01        24093      6630     19522         0      0.00         0      0.00         0      0.00
18:30:01        24441      6630     19738         0      0.00         0      0.00         0      0.00

What I am referring too, is the file-sz value increasing, in fact on the system in question it continues to increase until it hits the system limit and then processes start to fail. Which is not what I want.

Any tips of trying to pin point the application that might be causing it and any associated commands. Platform is RHEL 5.3 x64, system is used to run three Oracle Database instances.

I have a suspicion against a possible application, and intend of having it shutdown at some point and then monitoring the output from the sar -v for several samples to determine if I see the same pattern as per the output above.

EDIT: I believe I think I found the cause, but won’t know until I can get approval to make the change and reboot the host. I had a feeling it might be something to do with nagios and some scripts that check various things. Still believe this to be the case, as I have found an issue with nrpe itself on the host. Will get the approval to make the changes and reboot. Then will post back outcome.