Sharing a nice articles which I found on web. Hope it will be useful to you as well..
You might have this scenario; Logfiles deleted while the process is still running. That's annoying: On your Linux-Server the /var filesystem is nearly full. You remove a very large logfile that you don't need with the rm command:
myserver1# df -Ph /var
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/root-var 7.1G 7.0G 100M 99% /var
myserver1# ls -l /var/log/myapp/userlog
myserver1# rm /var/log/myapp/userlog
myserver1# df -Ph /var
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/root-var 7.1G 7.0G 100M 99% /var
But what's that? The filesystem is still full. With lsof you can see, that the logfile is still opened in write mode:
myserver1# lsof | grep var/log/myapp/userlog
myapp 25139 root 4w REG 3,12 0 2101404 /var/log/myapp/userlog (deleted)