lsof to find large open files

Was having a space allocation problem with a ceph host and couldn’t figure out what was holding files open.. finally listed lsof by size

lsof | grep REG | awk '{ print $1,$7,$9 }' | sort -t ' ' -k 2 -V

Found rsyslog had huge files open

splunkd REG 16400942226
splunkd REG 16400942226
splunkd REG 16400942226
splunkd REG 16400942226
rsyslogd REG 164487529796
rsyslogd REG 164487529796