Deleted Files Still Open - How do you track them.

[Steve Slade]

Hi,

I recently had the situation whereby a 2GB partition was at 100%, but du only showed a usage of around 100MB.

It turns out that a user had a process which created a large file. They had noticed this and deleted the file, but the process still had a handle to file, so the file was still allocated on the disk. When the process ended, the disk space was re-allocated.

In this case I was lucky that I had been made aware of this process, and that we killed it. If this happens again, I would like to know of way of tracking any files/processes in this situation.

I know that I track partition usage via fuser, and I could then use glance to track files open by a process. Does anybody know of any other, (maybe neater/quicker) way.

Many thanks.

Stev

[harry d brown jr · Accepted solution]

If you don't already have lsof, then download it from :

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.55/

[Lou Zirko_1]

As Harry said get lsof. This program can be your friend in a lot of cases.

Lou Zirko

[A. Clay Stephenson]

Hi Steve:

While fuser can usually track down theses processes lsof always can. Download it from any of the HP-UX Porting Centres. The binaries are available from 10.20 and 32-bit 11x if you have 64-bit 11x, you will need to download the source and compile it (at least the last time I looked). lsof is one of those tools every sysadmin should have.

Clay

[Steve Slade]

It seems that there is a consensus of opinion


Many Thanks

A Happy Camper.