commandlinefu.com is the place to record those command-line gems that you return to again and again.
You can sign-in using OpenID credentials, or register a traditional username and password.
Subscribe to the feed for:
I have come across a situation in the past where someone has unlinked a file by running an 'rm' command against it while it was still being written to by a running process.
The problem manifested itself when a 'df' command showed a filesystem at 100%, but this did not match the total value of a 'du -sk *'.
When this happens, the process continues to write to the file but you can no longer see the file on the filesystem. Stopping and starting the process will, more often than not, get rid of the unlinked file, however this is not always possible on a live server.
When you are in this situation you can use the 'lsof' command above to get the PID of the process that owns the file (in the sample output this is 23521).
Run the following command to see a sym-link to the file (marked as deleted):
cd /proc/23521/fd && ls -l
Truncate the sym-link to regain your disk space:
I should point out that this is pretty brutal and *could* potentially destabilise your system depending on what process the file belongs to that you are truncating.
If you can do better, submit your command here.
You must be signed in to comment.