Wednesday, January 13, 2016

remove large files that are open but have been deleted lsof


For find top 10 largest file 

du -a / | sort -n -r | head -n 10


/]# du -sh *  it also not showing free space then check For Check Open file which are deleted but not clear innode


lsof | grep '(deleted)'

to clear files without closing process use gdb for debug 

gdb -p 24268       (24268) is process id


(gdb) p close(4)     
$1 = 0
(gdb) q



you need to add  " p close(4) " manually 4 is value which come in 4th row when you put lsof | grep '(deleted)'  command

example

 lsof | grep '(deleted)'

httpd     23782     root   27u      REG              202,1         0       1225 /tmp/.ZendSem.DywBoH (deleted) 
 
tail      24268 root  3r      REG              202,1 100544279     921329 nohup.out (deleted)

in this case (gdb) p close(3)  after quit it will show free space without closing process or command  



To truncate it:
: > /path/to/the/file.log
If it was already deleted, on Linux, you can still truncate it by doing:
: > "/proc/$pid/fd/$fd"
Where $pid is the process id of the process that has the file opened, and $fd one file descriptor it has it opened under (which you can check with lsof -p "$pid".
If you don't know the pid, and are looking for deleted files, you can do:
lsof -nP | grep '(deleted)'
lsof -nP +L1,is an even better (more reliable and more portable) option (list files that have fewer than 1 link).
Or (on Linux):
find /proc/*/fd -ls | grep  '(deleted)'
Or to find the large ones with zsh:
ls -ld /proc/*/fd/*(-.LM+1l0)

lsof -p $(pidof process name)
gdb -p $(pidof process name)
(gdb) p close(4)
$1 = 0
(gdb) q
http://serverfault.com/questions/501963/how-to-recover-free-space-on-deleted-files-without-restarting-the-referencing-pr