Questions to Determine

• Which files under /var/log are consuming the most space?
• Is logrotate configured for the application log, and is the configuration correct?
• Is the logrotate cron job running successfully?
• Does the application reopen its log file after rotation (does it respond to SIGHUP or use copytruncate)?
• Is journald also consuming significant disk space?
• Are there compressed old logs that can be purged?
• What is the log verbosity level of the application -- is it logging at DEBUG in production?
• Are there deleted files still held open by running processes?