How to troubleshoot when a xfs filesystem is full without any clear reason?

Issue

df reports that the root partition is almost full, but the reason is not found with du and actual used disk space is 1GB only.

 [root@radosgw02 ~]# df -i
   Filesystem            Inodes IUsed  IFree IUse% Mounted on
   /dev/mapper/rhel-root  32016 31246    770   98% /
   devtmpfs              482968   354 482614    1% /dev
   tmpfs                 485301     1 485300    1% /dev/shm
   tmpfs                 485301   366 484935    1% /run
   tmpfs                 485301    13 485288    1% /sys/fs/cgroup
   /dev/vda1             512000  1128 510872    1% /boot

 [root@radosgw02 ~]# df -T
   Filesystem            Type     1K-blocks     Used Available Use% Mounted on
   /dev/mapper/rhel-root xfs       27740944 27740924        20 100% /
   devtmpfs              devtmpfs   1931872        0   1931872   0% /dev
   tmpfs                 tmpfs      1941204        0   1941204   0% /dev/shm
   tmpfs                 tmpfs      1941204    57684   1883520   3% /run
   tmpfs                 tmpfs      1941204        0   1941204   0% /sys/fs/cgroup
   /dev/vda1             xfs         508588   168228    340360  34% /boot

 [root@radosgw02 /]# du -sh *
   0       bin
   136M    boot
   0       dev
   22M     etc
   0       home
   0       lib
   0       lib64
   0       media
   0       mnt
   0       opt
   du: cannot access ‘proc/11424/task/11424/fd/4’: No such file or directory
   du: cannot access ‘proc/11424/task/11424/fdinfo/4’: No such file or directory
   du: cannot access ‘proc/11424/fd/4’: No such file or directory
   du: cannot access ‘proc/11424/fdinfo/4’: No such file or directory
   0       proc
   1.2M    root
   89M     run
   0       sbin
   0       srv
   0       sys
   4.0K    tmp
   887M    usr
   111M    var