Depending on your distribution, I believe that what you actually did was delete an open file.
The space will be reclaimed when the file is closed.
One way of doing that is to restart syslog.
An easier way is to identify the syslogd daemon (ps, it is likely called rsyslogd) and use "kill -1 $(cat /var/run/rsyslogd.pid)".
You can check the rsyslogd manpage for details:
Rsyslogd reacts to a set of signals. You may easily send a signal to
rsyslogd using the following:
kill -SIGNAL $(cat /var/run/rsyslogd.pid)
Note that -SIGNAL must be replaced with the actual signal you are try‐
ing to send, e.g. with HUP. So it then becomes:
kill -HUP $(cat /var/run/rsyslogd.pid)
HUP This lets rsyslogd perform close all open files. Also, in v3 a
full restart will be done in order to read changed configuration
files. Note that this means a full rsyslogd restart is done.
This has, among others, the consequence that TCP and other con‐
nections are torn down. Also, if any queues are not running in
disk assisted mode or are not set to persist data on shutdown,
queue data is lost. HUPing rsyslogd is an extremely expensive
operation and should only be done when actually necessary. Actu‐
ally, it is a rsyslgod stop immediately followed by a restart.
Future versions will remove this restart functionality of HUP
(it will go away in v5). So it is advised to use HUP only for
closing files, and a "real restart" (e.g. /etc/rc.d/rsyslogd
restart) to activate configuration changes.
As stated above, the "logrotate" script will do this for you, and you can use its configuration file to limit the size of log files, having various daemons close their log files as well automatically.