What LIVE/OPEN Files were Deleted? lsof comes to mind but..

[Alzhy]

..it does not display the full paths of the files - at least on the version 4.66 that we use.

Any other means to pinpoint what the names of the files were?

Am just trying to give proof to a client who's complaining that the total number of files/dirs on his currently full filesystem do not add up -- 20GB total capacity, du on all files/dirs and summing it up only adds ip to 12 GB .. so where did the 8GB go?

Any other tricks aside from LSOF?

[TwoProc]

Nelson, is it showing the "inode" of the file?

If so, you can do a find on a file system for an inode.

find -inum


Another thought - are there Oracle TEMP files on this directory.

[Wouter Jagers]

As described in http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1089548 , you could try the +I1 option to lsof. With a little luck you can find out which process is the 'nasty' one.

Cheers

[Wouter Jagers]

+L1

sorry.

[Sandman!]

You could use fuser but lsof would be the preferred tool of choice. Try the command below:

lsof +aL1 //*

[Bill Hassell]

There have been several posts on this subject...the 'size' of a directory is expressed in two different ways: logical size and occupied space. A sparse file is created when a file is created and random records are created at non-sequential offsets. For example, a file is written at record 1 and another record written at position 1000. The file contains 1000 records (logical size) but only two physical records were written.

Create your own sparse file with:

dd if=/etc/issue of=/var/tmp/sparse bs=4096k seek=1

where you will see the original file is just a few dozen bytes, the result with ls -l or wc -c shows a 4 meg file, but du will show the file as occupying just a bit more than the original /etc/issue file. A cp of the file will create a new file that is the same size (using ls -l or wc -c) but du will now show a MUCH larger size than the original file and it will use more inodes. However, both the original and the copy will diff exactly the same and programs cannot tell any difference between the two files.