Timeline for Find and remove large files that are open but have been deleted
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 14, 2022 at 9:09 | history | protected | dr_ | ||
| Jun 14, 2022 at 8:33 | comment | added | user516667 | @dotancohen vim writes a new file when told to, it doesn't modify the existing file. The new file is then moved on top of the old file. Try using ls -i to follow this. | |
| Jun 14, 2022 at 5:30 | answer | added | Shnbook | timeline score: -1 | |
| S Jan 13, 2017 at 21:35 | history | suggested | рüффп | CC BY-SA 3.0 | reformatting & removed thanks |
| Jan 13, 2017 at 21:19 | review | Suggested edits | |||
| S Jan 13, 2017 at 21:35 | |||||
| Jul 9, 2014 at 22:15 | answer | added | user75021 | timeline score: 61 | |
| May 1, 2014 at 18:27 | history | edited | Braiam | edited tags | |
| Mar 21, 2013 at 6:08 | vote | accept | dotancohen | ||
| Mar 20, 2013 at 22:58 | history | edited | Gilles 'SO- stop being evil' | edited tags | |
| Mar 20, 2013 at 13:45 | comment | added | Olivier Dulac | @dotancohen: try using : tail -f /tmp/somefile on one terminal and rm /tmp/somefile on another terminal. tail -f will keep the fd open until you stop it. Not sure vi/vim will keep the fd open when not needed... and use : lsof -p PID to see all fd of process PID (ie, the tail). to find its pid : before deleting the file: ps -ef | grep '/tmp/[s]omefile' ([s]omething greps for "something", and thus will not show the "grep ...." line as that line contains s]omething instead) | |
| Mar 20, 2013 at 11:23 | comment | added | dotancohen | I created somefile and opened it in VIM, then rmed it in another bash process. I then run lsof | grep somefile and it is not in there, even though the file is open in VIM. | |
| Mar 20, 2013 at 11:14 | comment | added | Stéphane Chazelas | @Johan, the lsof | grep '(deleted)' works on Linux as well. On Linux, you can be notified of file deletion (even files that already don't have any entry in any directory other than /proc/some-pid/fd anymore) with the inotify mechanism (IN_DELETE_SELF event) | |
| Mar 20, 2013 at 9:10 | history | edited | dotancohen | CC BY-SA 3.0 | added 78 characters in body |
| Mar 20, 2013 at 8:43 | comment | added | Johan | @donothingsuccessfully The "deleted" tag reported by lsof is Solaris specific, in fact Solaris 10 or later only. The OP did not specify what operating system he is using. @dotancohen On Solaris you can pipe the output of lsof to search for deleted, eg lsof | grep "(deleted)". When there are no more processes holding a deleted file open, the kernel will free up the inode and disk blocks. Processes do not have "handlers" by which they can be notified that an open, essentially locked file, have been removed from disk. | |
| Mar 20, 2013 at 8:42 | answer | added | peterph | timeline score: 3 | |
| Mar 20, 2013 at 8:42 | answer | added | Stéphane Chazelas | timeline score: 213 | |
| Mar 20, 2013 at 8:17 | comment | added | dotancohen | Thanks. How might one get the PIDs of all rmed files that are still open? | |
| Mar 20, 2013 at 8:15 | comment | added | donothingsuccessfully | If you know the pid then you can use lsof -p <pid> to list its open files and their sizes. The deleted file will have a (deleted) next to it. The deleted file will be linked at /proc/<pid>/fd/1 probably. I don't know how to make a process stop writing to its file descriptor without terminating it. I would think that would depend on the process. | |
| Mar 20, 2013 at 7:31 | history | asked | dotancohen | CC BY-SA 3.0 |