You may notice that one of the RTRs is lacking disk space under /var. There are no obvious problems and no directory is taking up a lot of space. When df -h is run, it returns something like:
/dev/xxx 79G 66G 8.9G 89% /var
Locate all unlinked but held open files
You can find all those files by running:
# lsof | grep '(deleted)'
If you want to specify the files in a particular directory, use the following command:
# lsof | grep "/var" | grep deleted
The result will be similar to this:
Force rsyslog to release the file
Determine how to release the file
When another application is holding the file, you will need to determine how to force it to release the file or create a support ticket.