lsof +L1

List open files that have no links to them on the filesystem

I have come across a situation in the past where someone has unlinked a file by running an 'rm' command against it while it was still being written to by a running process. The problem manifested itself when a 'df' command showed a filesystem at 100%, but this did not match the total value of a 'du -sk *'. When this happens, the process continues to write to the file but you can no longer see the file on the filesystem. Stopping and starting the process will, more often than not, get rid of the unlinked file, however this is not always possible on a live server. When you are in this situation you can use the 'lsof' command above to get the PID of the process that owns the file (in the sample output this is 23521). Run the following command to see a sym-link to the file (marked as deleted): cd /proc/23521/fd && ls -l Truncate the sym-link to regain your disk space: > /proc/23521/fd/3 I should point out that this is pretty brutal and *could* potentially destabilise your system depending on what process the file belongs to that you are truncating.
Sample Output
COMMAND     PID   USER   FD   TYPE DEVICE    SIZE NLINK   NODE NAME
a-proc    23521   root    3u   REG    8,1 5595979     0 353398 /some/logfile (deleted)

16
By: dopeman
2010-07-14 17:21:01

These Might Interest You

  • A potential source of a full filesystem are large files left open but have been deleted. On Linux, a file may be deleted (removed/unlinked) while a process has it open. When this happens, the file is essentially invisible to other processes, but it still takes on physical space on the drive. Tools like du will not see it.


    0
    sudo lsof -nP | awk '/deleted/ { sum+=$8 } END { print sum }'
    jeffskinnerbox · 2015-09-19 00:45:23 3
  • This will list your phone's filesystem with bitpim. (works on many LG, Samsung, and Sanyo) See http://www.bitpim.org/help/phones-featuressupported.htm for full list.


    0
    bitpim -p $PHONE_PORT ls
    matthewbauer · 2010-04-09 02:20:53 0
  • This will download all files of the type specified after "-A" from a website. Here is a breakdown of the options: -r turns on recursion and downloads all links on page -l1 goes only one level of links into the page(this is really important when using -r) -H spans domains meaning it will download links to sites that don't have the same domain -nd means put all the downloads in the current directory instead of making all the directories in the path -A mp3 filters to only download links that are mp3s(this can be a comma separated list of different file formats to search for multiple types) -e robots=off just means to ignore the robots.txt file which stops programs like wget from crashing the site... sorry http://example/url lol..


    3
    wget -r -l1 -H -nd -A mp3 -e robots=off http://example/url
    trizko · 2013-07-13 02:00:23 0
  • The tag function takes a tag name as its first argument, then a list of files which take that tag. The directory $HOME/tags/tagname will then hold symbolic links to each of the tagged files. This function was inspired by tmsu (found at https://bitbucket.org/oniony/tmsu/wiki/Home). Example: tag dog airedale.txt .shizturc weimeraner.pl This will create $HOME/tags/dog which contains symbolic links to airedale.txt .shizturc and weimeraner.pl


    2
    tag() { local t="$HOME/tags/$1"; [ -d $t ] || mkdir -p $t; shift; ln $* $t;}
    bartonski · 2012-02-08 12:40:45 4
  • This command will place symbolic links to files listed in an m3u playlist into a specified folder. Useful for uploading playlists to Google Music. prefix = The full path prefix to file entries in your .m3u file, if the file paths are relative. For example, if you have "Music/folder/song.mp3" in your list.m3u, you might want to specify "/home/username" as your prefix. list.m3u = Path to the playlist target_folder = Path to the target folder in which you would like to create symlinks


    1
    (IFS=$'\n'; ln -sf $(awk '((NR % 2) != 0 && NR > 1) {print "prefix" $0}' list.m3u) target_folder)
    lxe · 2011-09-25 16:45:28 2
  • The symlinks command can show status of all symbolic links, including which links are dangling, which symlinks point to files on other file systems, which symlinks use ../ more than necessary, which symlinks are messy (e.g. having too many slashes or dots), etc. Other useful things it can do include removing all dangling links (-d) and converting absolute links to relative links (-c). The path given must be an absolute path (which is why I used $(pwd) in the example command).


    6
    symlinks -r $(pwd)
    kFiddle · 2009-05-01 23:33:10 1

What Others Think

I normally use "lsof | grep deleted" for this then restart the process with the file open to resolve these types of issues. Files with a link count less than 1 can also mean someone is trying to hide something...
zlemini · 409 weeks and 4 days ago
You can restrict the output to a certain file system, e.g. /var, like this: lsof +aL1 /var
inof · 409 weeks and 4 days ago

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: