Hosting Operations

Read-only, can be slow

Find Open Deleted Files with lsof

Disk space did not return after deleting files, and you need to spot deleted files that are still held open by running processes.

Command

lsof +L1

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Do not treat this as the cleanup action. It identifies the process holding the file; releasing space may require a planned restart or log reopen.

Expected output

A list of open deleted files, including command, PID, file descriptor, size, and path.

System impact

Read-only, can be slow. Nothing changes. The command lists open files with link counts below one; paths and process names may expose service details.

Scope this to the smallest useful path or service on busy systems.

Recovery / rollback: no state is changed.

When to use it

Use when cleanup seemed successful but `df` still shows the space as used.

When not to use it

Do not treat this as the cleanup action. It identifies the process holding the file; releasing space may require a planned restart or log reopen.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        25G   19G  5G  80% /work
tmpfs           982M   12M  970M   2% /run

$ lsof +L1

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NLINK NODE NAME
nginx    1907 www    12w   REG  253,1 524288000     0 9123 /var/log/nginx/access.log (deleted)
worker   1842 app     5w   REG  253,1 104857600     0 9911 /tmp/job-output.log (deleted)

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

df -h
lsof +L1

next steps

Related commands

Hosting Operations Can be slow

Rank Old Cleanup Candidates by Size

The oldest file is not always the file that buys back meaningful space.

find /lab/disk-inode-cleanup/var -xdev -type f -mtime +7 -printf '%s %TY-%Tm-%Td %p\n' | sort -nr | head

Hosting Operations Can be slow

Find Release Files Writable Outside the Owner

A release file that someone besides the owner can modify deserves a second look.

find fixtures/perm-audit/releases/2026-06-25 -type f -perm /0022 -printf '%M %u:%g %p\n' | sort

Hosting Operations Can be slow

Preview Old Temp Files Before Deleting

The safe version of cleanup is a candidate list first.

find /lab/disk-inode-cleanup/var/tmp/uploads -xdev -type f -mtime +7 -printf '%TY-%Tm-%Td %10s %p\n' | sort

Hosting Operations Can be slow

Find the Processes Eating Memory

Memory pressure can look like a slow app, a stuck deploy, or random crashes.

ps -eo pid,ppid,stat,pcpu,pmem,rss,comm,args --sort=-pmem | head -n 10

Hosting Operations Read-only

Find Long-Running PostgreSQL Queries

One query can make the whole app look broken.

psql -X -c "select pid, now() - query_start as age, state, left(query, 80) as query from pg_stat_activity where query_start is not null order by age desc limit 10;"

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

Find Open Deleted Files with lsof

Before you run this

Expected output

System impact

When to use it

When not to use it

Command transcript

Commands shown

Related commands

Rank Old Cleanup Candidates by Size

Find Release Files Writable Outside the Owner

Preview Old Temp Files Before Deleting

Find the Processes Eating Memory

Find Long-Running PostgreSQL Queries

Useful for