Can I find out what's causing the big increment (LVM)

[marama]

Hi there!
ESXi 5.5, Veeam BR 8, Centos VM, 1.5 TB LVM
THe daily increment says it's 40G big (36G compressed), but I don't think that we had 40G of new/changed data on the storage.
I've identified the changed VMDK (2 vmdk out of 13 hat some 18G change each) but that's all I could find out.
It's probably not a Veeam-topic, more LVM one, but I was wondering if anyone here could tell me if there is a way to find out what's causing the big increment. I don't think there were any checkdisk operations.
TIA

[Gostev]

Hi. Is there some database or mail application running in this VM?

[marama]

Hi!
Find revealed some 5GB of modified data. No mailserver, there is a small DB, total of 530MB and small usage.
Bye

[foggy]

Check for some in-guest activity prior to that backup that could result in VMDK blocks changes. Is it just this single increment that you're concerned about or this is a common size for the daily increment?