topic Re: open files in Operating System - HP-UX

open files

Alistair Tonner — Wed, 07 May 2003 16:38:51 GMT

when a process was dumping data to a file in / file system, the file was deleted.
"bdf /" and "du -ksx /" show a big difference of 120MB about space used. How to know which process was writing to the deleted file? How to get the space back?

Re: open files

John Poff — Wed, 07 May 2003 16:47:22 GMT

Hi,

The process is still running and still writing to the disk even though the file was deleted. If you have Glance installed you can use it to try to find the process holding open the file, but a better tool would be lsof. Try the HP-UX Porting Center to get a copy of lsof.

JP

Re: open files

John Poff — Wed, 07 May 2003 16:48:53 GMT

I forgot to add that once you find the process writing to the file, you can just terminate it or kill it and your space should be freed up.

JP

Re: open files

Steven E. Protter — Wed, 07 May 2003 16:52:24 GMT

You can kill all the processes on a filesystem as follows:

fuser -cuk /fs_name

Use with caution, you can bring down your machine if you're not careful.

SEP

Re: open files

Alistair Tonner — Wed, 07 May 2003 16:53:53 GMT

The file was deleted in fear of root file system full. We do have "lsof" utility installed. However, without file name, without knowing which process, how can we identify cause they are so many open files in root file system. The file deleted was a core file.

Re: open files

John Poff — Wed, 07 May 2003 17:01:51 GMT

Hi,

Try running lsof and see what you get in the Name column. It normally lists the name of the open file, but I'm guessing that it will list the filesystem/logical volume and inode number for the process with the deleted, which should be a hint.

JP

Re: open files

Michael Steele_2 — Wed, 07 May 2003 22:58:53 GMT

lsof -p pid
lsof -u uid
lsof /file_system

Man 'lsof' :

http://hpux.cict.fr/hppd/hpux/Sysadmin/lsof-4.64/man.html