Deleted files can still fill a disk

When df says a filesystem is full but du can’t find the space, a process is usually holding a deleted file open. The blocks aren’t freed until the last file descriptor closes.

lsof +L1

+L1 lists open files with a link count below one, which means unlinked but still open. Restart the process, or truncate the file through its descriptor if you can’t:

: > /proc/<pid>/fd/<fd>