Was having a space allocation problem with a ceph host and couldn’t figure out what was holding files open.. finally listed lsof by size
lsof | grep REG | awk '{ print $1,$7,$9 }' | sort -t ' ' -k 2 -V
Found rsyslog had huge files open
splunkd REG 16400942226 splunkd REG 16400942226 splunkd REG 16400942226 splunkd REG 16400942226 rsyslogd REG 164487529796 rsyslogd REG 164487529796