# lsof | grep deleted
auditd 1103 root 5w REG 202,1 2324183 8046 /var/log/audit/audit.log (deleted)
nginx 1371 root 2w REG 202,1 18478 132207 /var/log/nginx/error.log (deleted)
nginx 1371 root 4w REG 202,1 18478 132207 /var/log/nginx/error.log (deleted)
nginx 1371 root 5w REG 202,1 26100615 131227 /var/log/nginx/access.log (deleted)
nginx 1372 nginx 2w REG 202,1 18478 132207 /var/log/nginx/erro…