Use the lsof
command to determine if some process is using the deleted files and then stop that process:
# lsof /var
cbsalarmm 3777 root 13w REG 253,1 744056352 64037 /var/log/alarm_xmlrpc.log (deleted)
If you see any file with (deleted) at the end, it is most likely the file which is blocked by some process.
Check to see if there is a daemon associated with the PID, such as cbsalarmmgrd. For example if you see cbsalarmmgrd blocking the file, restart the cbsalarmmgrd service:
# service cbsalarmmgrd restart
In case you can't restart the service, note the PID of the process and stop the process by running the kill command:
# kill -9 <pid>
Please always verify if it is safe to reload the service or kill the process blocking the file.
If not sure please contact Crossbeam Technical Support.
Alternatively, reloading the module will free up the blocked files as well.