Lesson 1.38: Deleted files that still fill the disk
A disk at 96 per cent, yet du finds only a few gigabytes. The missing space usually belongs to a file someone deleted while a program still had it open: the name is gone, the data stays until the last process closes it. In the lab Northwind's order server is almost full after someone removed a huge debug log by hand. You compare df with du, find the unlinked file with lsof +L1, free the space without stopping the service, and fix the cause.
16 min
You will learn to
- Explain why deleting an open file frees no space
- Compare df and du to spot hidden usage
- Find unlinked open files with lsof +L1
- Free space through /proc/PID/fd
- Prevent it with proper log handling
Key terms
- Inode
- The file itself: data blocks, size, owner, mode. A name in a directory only points at it.
- Link count
- How many names point at an inode. rm removes a name and lowers the count.
- File descriptor
- A number a process uses for an open file; listed under /proc/PID/fd.
- Unlinked open file
- A file with no name left but still open; its space returns only when the last descriptor closes.
- df vs du
- df reports blocks in use on the file system; du adds up files reachable by name.
- copytruncate
- A logrotate option that copies a log and then empties it in place, for programs that can't reopen their files.
← Sandboxing a service with systemd · All lessons · File timelines and timestomping →