Find disk space held by deleted but open Linux files

Deleting a large log does not always make its disk space available immediately. If a running process still has the file open, the filesystem can retain its contents until the remaining references close. This commonly explains a sudden disagreement between 
df and the files you can find with 
du. It does not mean every space discrepancy has this cause.
Confirm the affected filesystem
Note the application path and compare mounted filesystem usage:
df -hT /var/log
findmnt -T /var/log
sudo du -x -h --max-depth=1 /var/log
Replace 
/var/log when another volume is affected. Compare equivalent scopes: the whole filesystem reported by 
df may also contain directories outside the one you scanned. A scan without enough permissions can miss files. Snapshots and filesystem accounting can also affect the comparison.
Identify open deleted files
If 
lsof is already installed, inspect unlinked open files:
sudo lsof -nP +L1
Look for a relevant mount, process name, PID and a large regular file. 
+L1 selects open files with a link count below one. Do not simply add every displayed size: a file can appear for several descriptors or processes, and not every entry represents reclaimable data on the full volume. Keep raw output private because paths can include customer or application details.
If the utility is missing and the disk is critically full, avoid installing packages just to obtain it. Send the existing evidence to support. For a known process, 
sudo ls -l /proc/1234/fd can show descriptor targets; replace 
1234 with the actual PID.
Release the reference safely
Establish which service owns the PID before changing it. A log writer may support a documented log-reopen operation; a database may require an entirely different procedure. Plan the smallest supported action with the application owner. There is no universal safe signal or reload command for every program.
Do not kill an unknown process, write into its 
/proc descriptors, or reboot the whole VPS as the first fix. Such actions can interrupt transactions or destroy evidence. Keep a second SSH session and arrange maintenance if a restart is required. This guide intentionally does not issue a restart for you.
Check the result
After the agreed action, rerun 
lsof and 
df. Confirm the relevant open-file entry disappeared and available space increased. Then review log rotation so the writer reopens its log correctly next time. If space did not return, stop repeating restarts and investigate the remaining filesystem usage. Include the affected mount, PID, service and approximate retained size in a support ticket.
Related CloudExa guides
Find visible disk usage
Identify the application service
Technical references
Linux unlink semantics
Upstream lsof manual