[CentOS] Unable to find the used space

> 
> # du -sh /*

Use 'du -xh --max-depth=1 /' it will clean up your output and show you
only things on the root partition.

And as someone else said, deleted but open files are not removed until
the file handle is closed. This is used by some applications to "hide"
totally temporary files. Do 'lsof | grep delete' to see such files.
(This technique is also used by malware to hide their files.)

P.