Find and remove large files that are open but have been deleted

When a process opens a file and then unlinks it, the file’s resources remain in use by the process, but the file’s directory entries are removed. Hence, even when you know the directory where the file once resided, you can’t detect it with ls.

This can be an administrative problem when the unlinked file is large, and the process that holds it open continues to write to it. Only when the process closes the file will its resources, particularly disk space, be released.

Lsof can help you find unlinked files on local disks. It has an option, +L, that will list the link counts of open files. That helps because an unlinked file on a local disk has a zero link count. Note: this is NOT true for NFS files, accessed from a remote server.

• Use the option to list all files and look for a zero link count in the NLINK column

You can also select upper bound for Nlink with +L<upper bound value>

You can also give the mount path using

more options here: https://www.akadia.com/services/lsof_quickstart.txt

https://unix.stackexchange.com/questions/68523/find-and-remove-large-files-that-are-open-but-have-been-deleted

https://apple.stackexchange.com/questions/148352/what-is-the-meaning-of-the-command-lsof-l1