Hello,

I have a weird thing going on. Recently our tmp reported that it was full and X stopped functioning, checking the disk usage we found out that root partition is full. But actually it isn't.

du reports

6.8M /bin
5.2M /boot
339K /dev
19M /etc
1.9G /home
1.0K /initrd
41M /lib
12K /lost+found
763M /misc
3.0K /mnt
1.3M /opt
1.0K /proc
4.6M /root
14M /sbin
29K /tftpboot
0 /tmp
5.0K /tmpsave
2.7G /usr
350M /var

where / usage is less than 90mb and / partiton is 500 mb itself.
But still df reports :

Filesystem 1K-blocks Used Available Use% Mounted on
/dev/hda5 505605 490003 0 100% /
/dev/hda1 101089 9379 86491 10% /boot
/dev/hda3 9716828 1928996 7294236 21% /home
none 127092 0 127092 0% /dev/shm
/dev/hda2 26589228 2802552 22436012 12% /usr
/dev/hda6 1027768 396872 578688 41% /var
//sinclair/benjamin$ 78172160 5611520 72560640 8% /misc/backup

We run fsck to make sure no disk errors present, rebooted several times to make sure open files are closed but still can't fixed the problem. I moved root and tmp directory to another partition creating symlinks, which enable me to run X again.

Any ideas how to resolve this problem and regain 400MB back?

If "recently" means any date you can guesstimate, why not use "find" and look for stuff amassed since that date?