On August 28 my laptop sat at 88 % disk. I deleted a 44.6 GB video intermediate I could rebuild any time. du on the folder dropped 44 GB. df on the filesystem moved 5. XFCE's thumbnailer, tumblerd, still had the file open, and a deleted file's blocks come back only when the last descriptor closes. pkill -x tumblerd returned the space instantly.
When du and df disagree, the gap is deleted-but-open files, and lsof +L1 names them. For the usual case, where something real grew, the order is two commands:
du -ah / --exclude=/proc --exclude=/sys --exclude=/dev 2>/dev/null \
| sort -rh | head -n 20
find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null
The -h in sort -rh is load-bearing. I fed four size lines to both variants: sort -rn ranked 850K above 13G because it reads leading digits and stops. The excludes matter too: /proc/kcore on my laptop reports 128 TiB on an 868 GB disk, and any scan that walks it wastes minutes or reports nonsense.
On a server, when the full file is a log a live service still writes, skip rm and truncate in place with : > access.log, which keeps every open descriptor valid and frees the space without a restart.
Thresholds, exclude patterns and a recent-growth variation are on the find large files page.