I managed to resize the /var directory with the Gparted live CD due to the urgency I had in executing the process, however, while I was waiting for the Gparted .iso it occurred to me to try to resize the partition "live". To complete this task I read that I should first unmount /var.
It so happens that I tried to unmount /var but the system gave me a message saying (words more, words less) that there was a process running in /var and being busy the unmount could not be performed.
I took it upon myself to do some research and didn't find a concrete and convincing explanation as to why /var can't be unmounted from the same OS it's currently running on so I decided to give it a try.
I rebooted the machine (so as not to have any additional processes preventing me from running the process) and forcefully unmounted /var through the terminal. The machine in response to my action generated a visible "blink" on the monitor, I clarify that it was not a system restart because when the screen turned on again it did not boot but instead asked for a username and password as if it had returned from a state of suspension or hibernation.
So I was left with doubts about everything mentioned above. These doubts are:
1) Is it possible to "live" or "hot" resize /var?
2) Why did my machine "blink" when forcefully unmounting /var?
3) Which processes does it run that are important enough that when trying to unmount /var the system I got the message I mentioned above?
4) Why being so important at the programming level (among other things) the /var folder of the system (Debian for example) in its installation process, when performing a "guided" partitioning, provides such a negligible space compared to the entire of the disk? Is there any special reason for this?
Observation: I know that /var is a reference for certain services associated with web development (Apache, docker, among others) but I don't think they are the ones that generate this problem since there is no system "resistance" when stopping these services by terminal.
Observation 2: I have read many technology forums and sites but they do not explain with certainty a convincing reason for each of the doubts raised and I am one of those who likes to understand each process, tool, etc. as best as possible.
I thank you in advance for any help provided.
The lsof command can help you, you put the mount point and it tells you the processes that are with open files.
Here is an example of how to use it: