Disk space remains the same pre and post file deletion. It is likely a process is still using the deleted file. To get a list of deleted files which are still marked open by processes:

lsof +L1

COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
tuned   111 root    7u   REG  202,2     4333091     0 2141 /tmp/jar_cache23323.tmp (deleted)

Simply kill the process to dump the file in question:

kill -9 111

openssl x509 -noout -modulus -in certificate.crt | openssl md5

openssl rsa -noout -modulus -in private.key | openssl md5

Verify that the md5 values match exactly.

Browse to: http://graylog.host.net/api/cluster?pretty=true

Below is a result from a 1 node cluster:

{
  "6f8add5d0-f88-5ood9-de24-sdf78df9sd8f" : {
    "facility" : "graylog-server",
    "codename" : "Stiegl",
    "node_id" : "6f8add5d0-f88-5ood9-de24-sdf78df9sd8f",
    "cluster_id" : "ac27f8bc-472d-448a-a943-fdsfs89dfsdfc",
    "version" : "2.2.3+7adc951",
    "started_at" : "2019-03-25T10:47:58.384Z",
    "hostname" : "graylog.host.net",
    "lifecycle" : "running",
    "lb_status" : "alive",
    "timezone" : "Etc/UTC",
    "operating_system" : "Linux 4.14.77-70.59.amzn1.x86_64",
    "is_processing" : true
  }
}

tcpdump -i eth0 udp 'port 514'

openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out mycsr.csr