open files

[Alistair Tonner]

when a process was dumping data to a file in / file system, the file was deleted.
"bdf /" and "du -ksx /" show a big difference of 120MB about space used. How to know which process was writing to the deleted file? How to get the space back?

[John Poff]

Hi,

The process is still running and still writing to the disk even though the file was deleted. If you have Glance installed you can use it to try to find the process holding open the file, but a better tool would be lsof. Try the HP-UX Porting Center to get a copy of lsof.

JP

[John Poff]

I forgot to add that once you find the process writing to the file, you can just terminate it or kill it and your space should be freed up.

JP

[Steven E. Protter]

You can kill all the processes on a filesystem as follows:

fuser -cuk /fs_name

Use with caution, you can bring down your machine if you're not careful.

SEP

[Alistair Tonner]

The file was deleted in fear of root file system full. We do have "lsof" utility installed. However, without file name, without knowing which process, how can we identify cause they are so many open files in root file system. The file deleted was a core file.

[John Poff · Accepted solution]

Hi,

Try running lsof and see what you get in the Name column. It normally lists the name of the open file, but I'm guessing that it will list the filesystem/logical volume and inode number for the process with the deleted, which should be a hint.

JP

[Michael Steele_2]

lsof -p pid
lsof -u uid
lsof /file_system

Man 'lsof' :

http://hpux.cict.fr/hppd/hpux/Sysadmin/lsof-4.64/man.html