A filesystem is full, but deleting a large log does not free space. What could explain it?

A running process may still hold the deleted file open, so its blocks remain allocated until the last relevant reference is closed. Inspect deleted-but-open files with a suitable tool such as lsof when available and coordinate safe log reopening or service handling. Also check the correct mount, snapshots, reserved space, and whether inode exhaustion is the actual issue. du and df measure different things and can legitimately disagree. Avoid restarting unrelated services or truncating unknown file descriptors before identifying the owner and recovery implications.