Hosting Operations
Read-only, can be slowFind Open Deleted Files with lsof
Disk space did not return after deleting files, and you need to spot deleted files that are still held open by running processes.
Command
lsof +L1Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not treat this as the cleanup action. It identifies the process holding the file; releasing space may require a planned restart or log reopen.
Expected output
Open deleted files with command, PID, file descriptor, size, and deleted path. Large deleted files still count against disk until the owning process closes them.
System impact
Read-only, can be slow. Nothing changes. The command lists open files with link counts below one; paths and process names may expose service details.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use when cleanup seemed successful but `df` still shows the space as used.
When not to use it
Do not treat this as the cleanup action. It identifies the process holding the file; releasing space may require a planned restart or log reopen.
Sensitive output warning
lsof output can reveal usernames, private paths, sockets, databases, and application internals. Redact before sharing.
lsof +L1
Next safe step
After finding a large deleted-open file, identify the owning service and decide whether restart is safe. Do not kill the PID blindly.
ps -fp 1234systemctl status nginx --no-pager --lines=30
next steps
Related commands
Rank Old Cleanup Candidates by Size
The oldest file is not always the file that buys back meaningful space.
find /var -xdev -type f -mtime +7 -printf '%s %TY-%Tm-%Td %p\n' 2>/dev/null | sort -nr | head
Find System Cron Files Fast
A job can be nowhere in your crontab and still run every night.
find /etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly -maxdepth 1 -type f -print 2>/dev/null | sort
Find HTML Pages Missing from the Sitemap
A page can exist in the build but never make it into the sitemap.
find public -name '*.html' -print | sed 's#^public#https://example.com#' | while read -r url; do grep -q "$url" public/sitemap.xml || echo "$url"; done
Group Writable Files by Owning Group
Group-writable files are not automatically wrong, but the owning group decides the risk.
find /srv/www/example -type f -perm -0020 -printf '%g %M %p\n' 2>/dev/null | sort
Find Release Files Writable Outside the Owner
A release file that someone besides the owner can modify deserves a second look.
find /srv/www/example/releases/current -type f -perm /0022 -printf '%M %u:%g %p\n' 2>/dev/null | sort
next diagnostic step
Where to go from this command
- Linux disk full hub Use when deleted-open files explain disk usage that did not fall after deletion.
- Too many open files hub Use when open file counts, not deleted file size, are the incident signal.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.