John Fremlin's blog: Freeing space from open files on UN*X when deleting doesn't work

Your disk is filling up, you run du | sort -n | less and identify the culprit, then rm -f. But df tells you that the disk space is still used.

According to POSIX, the removal of the file contents shall be postponed until all references to the file are closed. A program must have the file open. Obviously, an easy way out is to kill all the programs using it, but sometimes you can't kill the program because it's doing something useful. First find which it is with lsof -nP +L1.

That tells you the pid and fd numbers. The file could actually be opened in multiple ways! However, you only need to truncate it once - by running : | sudo tee /proc/$pid/fd/$fd for one of these pairs.

Note that if the file is mmap'd the process might get SIGBUS. If it's just a logfile, this is unlikely!

Some people choose to first truncate before deleting logfiles to avoid chasing through this, i.e. : > $file; rm $file.