Disk & Filesystem Management (Du/Df/Lsblk/Fstrim)

Recover deleted files that are still hogging your disk space

🧩 The Challenge

Ever run a df check and see your root partition is 100% full, but when you run du on the directories, the numbers don’t add up? I’ve wasted an entire afternoon once trying to find a massive log file that didn’t exist in any folder because a process still had it open after deletion.

💡 The Fix

You can use lsof to track down these ghost files that are currently held open by a process even though they’ve been unlinked from the filesystem. It’s the only way to reclaim that hidden space without rebooting the server.

lsof +L1 /var/log/

⚙️ Why It Works

The +L1 flag tells lsof to look specifically for open files with a link count of less than one, which is exactly how Linux marks files that are deleted but still pinned in memory. Once you see which PID is holding the file descriptor, you can either kill the process or clear the handle to let the kernel finally free the blocks.

🚀 Pro-Tip: If you can’t restart the process, you can truncate the file directly to zero size by echoing nothing into the file descriptor file in /proc/PID/fd/.

Linux Tips & Tricks | © ngelinux.com | 9/20/2026