Posted 2017-12-29 23:00:00 GMT
Your disk is filling up, you run du | sort -n | less and identify the culprit, then rm -f. But df tells you that the disk space is still used.
According to POSIX,
the removal of the file contents shall be postponed until all
references to the file are closed. A program must have the file
open. Obviously, an easy way out is to kill all the programs using
it, but sometimes you can't kill the program because it's doing
something useful. First find which it is with lsof -nP +L1.
That tells you the pid and fd numbers. The file could actually be opened in multiple ways! However, you only need to truncate it once - by running : | sudo tee /proc/$pid/fd/$fd for one of these pairs.
Note that if the file is mmap'd the process might get SIGBUS. If it's just a logfile, this is unlikely!
Some people choose to first truncate before deleting logfiles to avoid chasing through this, i.e. : > $file; rm $file.
Post a comment