disk space keeps filling up on EC2 instance with no apperent files/directories

Solution 1:

If a file that has been deleted is still open by a process, the space will not be reclaimed until the process closes the file (or is killed). If you can not identify the process that is holding a file open, then a reboot will help as that will close all running processes (and so close all open files).

Another consideration is filesystem corruption. As this is your root filesystem you may need to reboot and force a filesystem check on restart (shutdown -rF now). Be sure that you are configured to perform a non-interactive scan+fix unless you have KVM access or similar (so you can interact during the boot process) otherwise your remote machine will hang waiting for local input if it finds errors during the check.

Edit: (as per question in comment)

If you know the process that is holding the file open, you can just restart that particular process (either via service stop/start/restart scripts or by killing and restarting more manually) rather than the whole instance.

Also some programs support being able to reset themselves without restarting which will usually include closing and restarting log files (solving your problem if it is indeed due to a deleted log file that is still open) in response to being sent a SIGHUP signal (via kill). Resetting processes this way is sometimes preferable as it reduces (often to zero) the amount of time a server process is unable to accept new connections. This is often what happens when you run /etc/init.d/<service> reload instead of /etc/init.d/<service> restart (if fact I've seen restart implemented this way so to do a proper full reset you have to do /etc/init.d/<service> stop; /etc/init.d/<service> start).

Solution 2:

Managed to reclaim the space without a restart for the process holding it open through the fd links in /proc//fd/.

1) get to the holding process file descriptors path:

cd /proc/`lsof|grep '<deleted_file>'|head -1|awk '{print $2}'`/fd

2) find process fd link:

ll | grep <deleted_file>

3) override with blank (all data will be lost)

 > <fd>