General
cancel
Showing results for 
Search instead for 
Did you mean: 

What LIVE/OPEN Files were Deleted? lsof comes to mind but..

 
Highlighted
Honored Contributor

What LIVE/OPEN Files were Deleted? lsof comes to mind but..

..it does not display the full paths of the files - at least on the version 4.66 that we use.

Any other means to pinpoint what the names of the files were?

Am just trying to give proof to a client who's complaining that the total number of files/dirs on his currently full filesystem do not add up -- 20GB total capacity, du on all files/dirs and summing it up only adds ip to 12 GB .. so where did the 8GB go?

Any other tricks aside from LSOF?

Hakuna Matata.
5 REPLIES 5
Highlighted
Honored Contributor

Re: What LIVE/OPEN Files were Deleted? lsof comes to mind but..

Nelson, is it showing the "inode" of the file?

If so, you can do a find on a file system for an inode.

find -inum


Another thought - are there Oracle TEMP files on this directory.

We are the people our parents warned us about --Jimmy Buffett
Highlighted
Honored Contributor

Re: What LIVE/OPEN Files were Deleted? lsof comes to mind but..

As described in http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1089548 , you could try the +I1 option to lsof. With a little luck you can find out which process is the 'nasty' one.

Cheers
an engineer's aim in a discussion is not to persuade, but to clarify.
Highlighted
Honored Contributor

Re: What LIVE/OPEN Files were Deleted? lsof comes to mind but..

+L1

sorry.
an engineer's aim in a discussion is not to persuade, but to clarify.
Highlighted
Honored Contributor

Re: What LIVE/OPEN Files were Deleted? lsof comes to mind but..

You could use fuser but lsof would be the preferred tool of choice. Try the command below:

lsof +aL1 //*
Highlighted
Honored Contributor

Re: What LIVE/OPEN Files were Deleted? lsof comes to mind but..

There have been several posts on this subject...the 'size' of a directory is expressed in two different ways: logical size and occupied space. A sparse file is created when a file is created and random records are created at non-sequential offsets. For example, a file is written at record 1 and another record written at position 1000. The file contains 1000 records (logical size) but only two physical records were written.

Create your own sparse file with:

dd if=/etc/issue of=/var/tmp/sparse bs=4096k seek=1

where you will see the original file is just a few dozen bytes, the result with ls -l or wc -c shows a 4 meg file, but du will show the file as occupying just a bit more than the original /etc/issue file. A cp of the file will create a new file that is the same size (using ls -l or wc -c) but du will now show a MUCH larger size than the original file and it will use more inodes. However, both the original and the copy will diff exactly the same and programs cannot tell any difference between the two files.


Bill Hassell, sysadmin