Q: 'df' reports partition is full but 'du' shows not full partition -- how to find where the problem
what would be a best approach for the following situation:
You have a web server and monitoring system reports that you short on
disk space. You login into web server computer and command 'df' indeed
shows that some partition is almost full.
How would you resolve the issue if 'du' does not confirm that disk is full.
You 'du' all directories in the root of the partition but sum does not
adds up to match 'Use%' reported by 'df'.
For such situation I would assume that some process holds huge open file
which was deleted (for example your web server was compromised).
Question: how would you find the process which holds 'deleted' file?