deleted-but-open file

A file whose last name rm removed while a process still held it open. The name is gone from the directory, so du, which walks the tree, can no longer reach it; the kernel keeps its inode and its blocks until the last descriptor closes, and the filesystem goes on counting them. A df -h / reporting 79G used and 0 available while sudo du -sh /var totals 12G does not prove one of the two tools is wrong: df asks the filesystem how many blocks it has reserved, du totals what a filename reaches, and the gap between the two numbers is the measurement. Deleting other files to bring df down destroys data that was never the cause and recovers not one byte. sudo lsof +L1 lists exactly these files, link count 0, and names the process holding them: restarting that service is what frees the space.