Comment # 18 on bug 1046962 from Mircea Kitsune

(In reply to Max Staudt from comment #17)

The problem is that, I'm not sure which file to follow or how, so I might need
more specific instructions. The little script you suggested looks like it might
work, but there are over 20 files inside debugfs. Perhaps the watch command can
be used to track changes in all of them?

This might however work in case we're talking a gradual leak, and not something
that all happens instantly (in less than a second) so that the system freezes
before it gets recorded. I'm still assuming it's all instant, but I just
realized the other option could still be the case too.