Shulou(Shulou.com)06/01 Report--

This article mainly introduces "how to find the deleted file under Linux". In the daily operation, I believe that many people have doubts about how to find the deleted file under Linux. The editor consulted all kinds of materials and sorted out simple and easy-to-use operation methods. I hope it will be helpful to answer the doubt of "how to find the deleted file under Linux". Next, please follow the editor to study!

In the daily operation and maintenance process, we often need to deal with disk space problems. When we receive an alarm, we will immediately look for those large files, such as Centos, which may be / var/log/messages.

But sometimes, there will be no way to find large files, through the du search, the statistical size, does not correspond to the occupied space displayed by df.

If you check through df-I that the inode is not full, it is very likely that a large file has been directly rm, but there are still processes that have opened the file.

In this case, because the process does not exit, the space occupied by the file is not released; the disk space is not really freed until the process exits.

How to find out which process opened the file

On Linux, because the process is still alive, you can view the fd opened by all processes, and if the file has been deleted, it will be displayed (deleted).

Examples are as follows:

$sudo find / proc/*/fd-ls | grep'(deleted) '388609 0 lrwx- 1 zerotier-one zerotier-one 64 Aug 21 00:19 / proc/29400/fd/4-> / tmp/ibpX85Vd\ (deleted) 388610 0 lrwx- 1 zerotier-one zerotier-one 64 Aug 21 00:19 / proc/29400/fd/5-> / tmp/ibCwAgAj\ (deleted) 388611 0 lrwx- 1 zerotier-one zerotier-one 64 Aug 21 00:19 / proc/29400/fd/6-> / tmp/ibRZ5rep\ (deleted) 388612 0 lrwx- 1 zerotier-one zerotier-one 64 Aug 21 00:19 / proc/29400/fd/7-> / tmp/ibBuNEzA\ (deleted) 388616 0 lrwx- 1 zerotier-one zerotier-one 64 Aug 21 00:19 / proc/29400/fd/11-> / tmp/ibG68kpG\ (deleted)

How to avoid this situation

Do not delete the file directly, but free up disk space by truncate the file.

One way is:

Cat / dev/null > ${filename}

Or (new get!)

: > ${filename} at this point, the study on "how to find the deleted file under Linux" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.