Why do RHEV hypervisors run out of disk space in /var/log?

Issue

• Why does df report a higher amount of disk usage than du for the filesystem where /var/log resides?

  # df -kh /var
  Filesystem            Size  Used Avail Use% Mounted on
  /dev/mapper/vgos-lvol_var
                         12G  6.2G  5.1G  55% /var
  
  # du -khs /var
  2.5G    /var
  

• Also, the following error message is shown in the RHEV Manager Audit log:

  Critical, Low disk space. Host has less than 500 MB of free space left on: /var/log