Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • 3
    If you know the pid then you can use lsof -p <pid> to list its open files and their sizes. The deleted file will have a (deleted) next to it. The deleted file will be linked at /proc/<pid>/fd/1 probably. I don't know how to make a process stop writing to its file descriptor without terminating it. I would think that would depend on the process. Commented Mar 20, 2013 at 8:15
  • Thanks. How might one get the PIDs of all rmed files that are still open? Commented Mar 20, 2013 at 8:17
  • @donothingsuccessfully The "deleted" tag reported by lsof is Solaris specific, in fact Solaris 10 or later only. The OP did not specify what operating system he is using. @dotancohen On Solaris you can pipe the output of lsof to search for deleted, eg lsof | grep "(deleted)". When there are no more processes holding a deleted file open, the kernel will free up the inode and disk blocks. Processes do not have "handlers" by which they can be notified that an open, essentially locked file, have been removed from disk. Commented Mar 20, 2013 at 8:43
  • 2
    @Johan, the lsof | grep '(deleted)' works on Linux as well. On Linux, you can be notified of file deletion (even files that already don't have any entry in any directory other than /proc/some-pid/fd anymore) with the inotify mechanism (IN_DELETE_SELF event) Commented Mar 20, 2013 at 11:14
  • I created somefile and opened it in VIM, then rmed it in another bash process. I then run lsof | grep somefile and it is not in there, even though the file is open in VIM. Commented Mar 20, 2013 at 11:23