Disk & Filesystem Management (Du/Df/Lsblk/Fstrim)

Stop deleting logs while the process is still holding onto them

🧩 The Challenge

You finally run out of space on your log partition, delete a massive 50GB file to clear room, and realize your df output hasn’t moved an inch. It’s infuriating when you think you’ve cleared the bottleneck, but the kernel is still keeping the file descriptor open.

💡 The Fix

Use lsof to hunt down the process that’s actually locking that deleted file so you can restart it or send it a signal. You can’t just remove the file and walk away; the filesystem won’t reclaim those blocks until the process lets go.

lsof +L1 /var/log/

⚙️ Why It Works

Adding the +L1 flag tells the tool to list all open files that have a link count of less than one, which is exactly what happens when you delete an active log. These orphaned files stay invisible to standard tools but continue to hog your disk space until you kill the process holding the handle.

🚀 Pro-Tip: If you don’t want to restart the process, truncating the file with echo > /proc/PID/fd/FILE_DESCRIPTOR is a safer hack to reclaim the space instantly.

Linux Tips & Tricks | © ngelinux.com | 9/9/2026