Find and remove large files that are open but have been deleted

When a process opens a file and then unlinks it, the file’s resources remain in use by the process, but the file’s directory entries are removed. Hence, even when you know the directory where the file once resided, you can’t detect it with ls.

This can be an administrative problem when the unlinked file is large, and the process that holds it open continues to write to it. Only when the process closes the file will its resources, particularly disk space, be released.

Lsof can help you find unlinked files on local disks. It has an option, +L, that will list the link counts of open files. That helps because an unlinked file on a local disk has a zero link count. Note: this is NOT true for NFS files, accessed from a remote server.

  • Use the option to list all files and look for a zero link count in the NLINK column
$lsof +L
COMMAND PID USER FD TYPE  DEVICE SIZE/OFF                  NLINK            NODE      NAME

networkse 826 atyagi txt REG 1,4  32768                     0              11651355    /private/var/db/mds/messages/1448332820/se_SecurityMessages
networkse 826 atyagi txt REG 1,4  25923264                  1              1557070    /usr/share/icu/icudt57l.dat
networkse 826 atyagi txt REG 1,4  698896                    1              6111216      /usr/lib/dyld 

You can also select upper bound for Nlink with +L<upper bound value>

$lsof +L
COMMAND PID USER FD TYPE  DEVICE SIZE/OFF NLINK            NODE      NAME 
Google 93071 atyagi976 txt REG 1,4 131072 0             11925760 /private/var/folders/_s/9ww5612s7nq3vyp8qx3mh4dsb57lhm/T/.com.google.Chrome.bg7wQk
Google 93071 atyagi976 6r REG 1,4 131072 0              11925760 /private/var/folders/_s/9ww5612s7nq3vyp8qx3mh4dsb57lhm/T/.com.google.Chrome.bg7wQk

You can also give the mount path using

$ lsof -a +L1 /home

 

more options here: https://www.akadia.com/services/lsof_quickstart.txt

https://unix.stackexchange.com/questions/68523/find-and-remove-large-files-that-are-open-but-have-been-deleted

https://apple.stackexchange.com/questions/148352/what-is-the-meaning-of-the-command-lsof-l1

Leave a Reply

Your email address will not be published. Required fields are marked *