Amit,
If you're interested in a third party commercial solution, our Enterprise Session Monitor for SAS addresses the exact challenge you're having (easily finding the user or program that is currently filling your SASWORK/UTIL disk). It measures the SASWORK size for each session in real time and at any time gives you a breakdown of exactly how that space is being used with one click. It can also tell you how that space was being used at any arbitrary point in time over the last 4 weeks, as well as doing a bunch of other stuff like automatically associating workspace sessions to the metadata users that own them, letting users keep an eye on what resources the sessions they own are currently using on the server, allowing superusers to clean up unwanted sessions very easily, etc. etc.
Check out this screencast on Vimeo - relevant bits are around 50 seconds in, and then again around 3 minutes in. Product page can be found here.
If you were on a UNIX-based OS, as a workaround I would suggest a couple of script-based solutions similar to what Kurt has suggested. Turning on SASWORK compression is a good idea but I'd definitely want to profile your disk throughput performance and look at CPU headroom before flicking the switch in production.
Hope that helps.
Nik
... View more