Disk & Filesystem Management (Du/Df/Lsblk/Fstrim)

Stop trusting df when files are lurking in deleted state

🧩 The Challenge

You look at df and see the disk is 99% full, but running du on the directories shows way less data usage. It’s infuriating because you know the space is occupied but you can’t find the massive file eating it up.

💡 The Fix

Use lsof to spot those ghost files that are still held open by a process even though they’ve been unlinked. This is the only way to find what’s actually keeping your disk space hostage after a botched log rotation.

lsof +L1

⚙️ Why It Works

Passing the +L1 flag tells the tool to list all open files with a link count of less than one, which are exactly the files that won’t release their blocks until the holding process dies.

🚀 Pro-Tip: Once you find the PID holding the file, don’t kill the process; just restart the service so it starts writing to a fresh log file.

Linux Tips & Tricks | © ngelinux.com | 9/10/2026