Recently faced with a similar phenomenon on one of the servers under CentOS. I have ran a process running under nohup, which in turn all its output into a text Lil nohup.out. The programmer forgot to remove a debug print in the code, therefore, the conclusion was very massive and in a couple of hours I had in the presence of a text file of 350 MB. To remedy the situation without having to restart the application, I just erased the file nohup.out, checked that he was not looming in the FS and calmed down. After a few hours my server successfully formed for lack of space on one of the sections. In short, I went to investigate and discovered a curious phenomenon. The file that I supposedly erased, well a existed in kako-it is invisible to the ls command and continued to grow until it ate all the space on the volume. The phenomenon is explained by the fact that if a process writes (or reads) in the file, then it catches and until either completes the burn process, or be killed myself writing process or restart the OS. Moreover, the commands df and du shows very different results (read more here
), exactly as you described. Therefore, it makes sense to check what's happening on a server, for example using the lsof command, it will show everything open by any processes, files, even invisible to the ls.
And the thesis that it's a marketing ploy your cloud provider, rather from the category of jokes humor :)