Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

"lsof" shows a file as (deleted) but I can still see it in file system

Tags:

linux

lsof

in Linux 2.6.27:

From "lsof" output I see a process holding open fd with a (deleted) file. The strange thing is that I can still see the file in the file system using "ls". Why is that?

thanks.

like image 933
user1783732 Avatar asked Aug 13 '13 04:08

user1783732


People also ask

How do I delete lsof deleted files?

$ lsof /app | grep deleted Will print all deleted files which are claiming disk space. You can just kill the process which is holding the reference of those files and get back your disk space. The command will also print the process id to help you kill the process. You can just kill command for that.

Why do files keep appearing after I delete them?

Your files may keep on coming back on your PC because it might be syncing from your cloud storage. You need to uninstall it or turn off the cloud storage syncing to see if you can get rid of the issue. Open the Control Panel. Go to Programs and Features.

What does deleted mean in lsof?

lsof is used to list all the deleted files which are still on disk due to open file descriptors. Memory is not immediately freed because the running process still has an open file handle to the just-deleted file.

Why is space not being freed from disk after deleting a file?

Available disk spaces does not increase after deleting files on an external drive. When a file is deleted, the space used on the disk is not reclaimed until the file is truly erased. The trash (recycle bin on Windows) is actually a hidden folder located in each hard drive.


2 Answers

When a file is deleted it would not been seen on the file system. However, it is quite possible another file with the same file name is created on the same location.

You can check the node number shown in lsof and ls -i to check whether they are really the same file.

like image 159
fefe Avatar answered Sep 22 '22 17:09

fefe


The file is not deleted as long as some process has the file open. When a file is closed, the kernel first checks the count of the number of process that have the file open. If this count has reached 0, the kernel then checks the link count; if it is 0, the file's contents are deleted.

To quote from man unlink:

If the name was the last link to a file but any processes still have the file open the file will remain in existence until the last file descriptor referring to it is closed.

like image 40
mohit Avatar answered Sep 23 '22 17:09

mohit