im literally losing my mind here our monitoring box started failing right after a backup run.. lmao services refuse to start, package installs fail, and monitoring shows:

Disk 0 (C:) Active time 100%
Not responding
df -h confirms /var is at 100%. I dont want to just rm things randomly on a production box. where should i look first?
This monitoring box has been running for years with very little attention, which is probably teh problem. Nobody remembers whats supposed to grow and what isnt. Id love a safe checklist i can follow without accidentally deleting something important. what am i doing wrong??