This was a weird issue for me. My /var was showing usage of 220GB using “df -h”. However, when I checked deeply with the du command and even adding all the hidden files, the usage was much lesser.
To sort this out, this command gave the list of open deleted files.
lsof -n | grep deleted.
Check any of the huge files which was deleted before are still being used by any process. In my case it was PostgresSQL which was removed from the server but was still running and using the deleted files.
Just killed of the unwanted process and saw that the deleted files was removed from lsof command. Now check the output of df -h, it should be showing the correct usage now.
Please be sure that you are know what you are doing before kill the process!
