Deleted files that still hold disk space

du -sh /var/log says 2G while df says 50G used. The missing 48G belongs to deleted files that are still open.

lsof +L1

lists open files with a link count of zero and the processes holding them. Typical cases: a log removed with rm while the application keeps writing, or nginx access.log deleted without a reload.

Restart the process, or truncate through /proc/<pid>/fd/<n> — works for regular files, not sockets.

Avoid rm on logs that are being written; use truncate -s 0 or let logrotate do it. When df and du disagree, this is the first thing to check.