>I do not understand why I must find deleted files?
You said it gets full after a few minutes. If this is not the logs and wtmps that you just removed, it could only be someone still writing to a deleted file.
Deleting log files is not always a good idea. If the files are large but you don't need the information, then truncate the files with either:
cat /dev/null > /var/adm/something.log
or
> /var/adm/something.log
so as to preserve the permission and ownership. If you simply delete a file -- and the file is still open -- the file will disappear from the directory but the space will not be returned. The process(es) keeping the file open must terminate before the space will be returned. Truncating the file reduces the size immediately. Since you deleted active logfiles, they are still growing but you cannot see them -- the name has been removed from the directory. Only a reboot will fix this. And when you have large log files, never delete or truncate them until you look at the most recent messages. You may have a critical disk or memory failure that must be resolved.
In general, start by finding the large directories (not files!). Use this command:
du -kx /var | sort -rn | head -20
which will sort all the directories by size, largest at the top. Then look inside the directory to see what is using all the space. DO NOT delete anything in /var/adm/sw! Use the cleanup command.
And to explain why a reboot fixed the problem, a process was probably creating a large file which you deleted. But as mentioned, the name disappears from the directory so you can't see it but until the process is terminated, the file is still there, continuing to grow. The reboot killed the process, and the space was reclaimed.
