Site icon New Generation Enterprise Linux

Stop trusting df when files are lurking in deleted state

Disk & Filesystem Management (Du/Df/Lsblk/Fstrim)

Stop trusting df when files are lurking in deleted state

đź§© The Challenge

You look at df and see the disk is 99% full, but running du on the directories shows way less data usage. It’s infuriating because you know the space is occupied but you can’t find the massive file eating it up.

đź’ˇ The Fix

Use lsof to spot those ghost files that are still held open by a process even though they’ve been unlinked. This is the only way to find what’s actually keeping your disk space hostage after a botched log rotation.

lsof +L1

⚙️ Why It Works

Passing the +L1 flag tells the tool to list all open files with a link count of less than one, which are exactly the files that won’t release their blocks until the holding process dies.

🚀 Pro-Tip: Once you find the PID holding the file, don’t kill the process; just restart the service so it starts writing to a fresh log file.

Linux Tips & Tricks | © ngelinux.com | 9/10/2026

0 0 votes
Article Rating
Exit mobile version