AIX

i have deleted qf's and df's in my /var/spool/mqueue and my /var still remains at 99% full.

when i check users i get this:
# fuser -xuc /var
/var: 8072c(root) 18404(root) 19420c(root) 23558c(root) 24276(root) 24770(root) 25284c(svcagent) 27102c(svcagent) 30242c(root) 33598(root) 38454c(root) 54872(adm)

my problem is i'm not sure which processes to kill. i cant restart the server because its production

When you identified the process IDs you need to check which process (command) responds to them. Use
ps -ef | grep <somepid(numberonly)youfound>
to find a process that writes to some file in that dir. And you probably don't need to KILL a process, you can always reduce size of the file the process writes into. Think I told you before already: use lsof if you cannot get the information by means of the operating system.

Btw. if /var grows full I'd start checking size of wtmp. If it is (too) big, either blank it or shrink it. This can be done during operation too. Search this forum or some other AIX groups to find out how.

thanx
using lsof i have seen that only one process was writing to directory and killed the rest. then the space changed

I'd like to discourage you from killing processes that originate from /var (and /,/usr... and with older versions of HACMP even from /tmp) as long as you don't know for sure that the server does not need them. Should you happen to kill a process that is vital for your server the results may be unpredictable.
It is all files in AIX (as in every UNIX) and therefore problems related to space in filesystems can be solved in a non disruptive way most of the time by either shrinking/blanking files (but not deleting!)during operation or extending filesystems online.