There may be core dump in /var/run/.
It has been seen that a file such as php-fpm.core with a large size of 3.3MB is seen.
SSH into the box and remove the core.
Run the following to determine any large files to remove.
du -hd1 /var/run/
Usage of var/run should drop back down to 4%.