Question

A web server's root filesystem is reporting 100% full, causing application errors. You delete a large 8 GB log file at /var/log/app/huge.log, but `df -h` still shows the filesystem as full. `du -sh /var/log/app` no longer accounts for the file's size. What is the most likely reason the space has not been reclaimed, and how can you confirm it?

Accepted Answer

A process still holds the deleted file open; run `lsof +L1` (or `lsof | grep deleted`) to find it and restart or signal that process to release the file handle.

Answer

The filesystem journal is corrupted; run `fsck` on the mounted root filesystem to reclaim the orphaned blocks immediately.

Answer

The inode table is exhausted; run `df -i` and delete additional small files to free inodes before space is returned.

Answer

The deletion is cached in the page cache; run `sync && echo 3 > /proc/sys/vm/drop_caches` to flush it and recover the disk space.