Ideally you would have identified the space usage culprit, deleted the file or folder, and when it DIDN’T fix the problem, you’d know what to look for in lsof.
For instance, /var/log/syslog is 5GB. rm /var/log/syslog. df has no effect. Interesting.
lsof -n |grep deleted
Find the process(es) keeping /var/log/syslog open, kill them or restart the services.
df shows freed up space.
At this point, lsof -n |grep deleted and see what’s holding things open. It’s only a hypothesis that /var/log was the culprit, and that rsyslog was holding those files open. lsof will give you the facts.
Note it’ll also tell you the PID, the process, the file, and how big the file is.
lsof -n |grep rsyslog |grep /var/log on my system shows
rsyslogd 928 syslog 9w REG 253,6 3376600 133058 /var/log/auth.log
rsyslogd 928 syslog 10w REG 253,6 33663657 131139 /var/log/snmpd.log
rsyslogd 928 syslog 11w REG 253,6 12631 131178 /var/log/syslog
rsyslogd 928 syslog 12w REG 253,6 3777817 131458 /var/log/commands.log
So rsyslogd is process 928, referencing a REGular file - /var/log/snmpd.log is 33MB.
Which is true:
ls -l /var/log/snmpd.log -h
-rw-r----- 1 syslog adm 33M Apr 7 15:20 /var/log/snmpd.log
I also have a couple deleted files
systemd-l 872 root txt REG 253,0 219272 4380 /lib/systemd/systemd-logind (deleted)
ulogd 922 ulog 8w REG 253,6 9314162 131246 /var/log/ulog/syslogemu.log.1 (deleted)
systemd 85260 jenkins txt REG 253,0 1595792 11866 /lib/systemd/systemd (deleted)
(sd-pam 85261 jenkins txt REG 253,0 1595792 11866 /lib/systemd/systemd (deleted)
I’m guessing you have A LOT at this point. Or at the very least you’re going to have 1 or a couple big ones if there is so much disparity between du -sx / and df .