Hosting Operations

Find Open Deleted Files with lsof

You need to spot deleted files still held by running processes after cleanup.

Command

lsof +L1

What changed

Nothing changes. The command lists open files with link counts below one.

Danger

safe

When to use it

Use when disk space remains used after deleting logs or temporary files.

When not to use it

Do not use it as a cleanup action; it only identifies processes and files.

Undo or recovery

No undo needed because this command is read-only.

Expected output

A list of open deleted files, including command, PID, file descriptor, size, and path.

demo script

Disposable terminal steps

df -h
lsof +L1

Terminal transcript Demo JSON

simulated output

What it looks like

disposable vessel

::fixture-ready::
$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        25G   23G  1.1G  96% /
tmpfs           982M   12M  970M   2% /run
::exit-code::0
$ lsof +L1
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NLINK NODE NAME
nginx    1907 www    12w   REG  253,1 524288000     0 9123 /var/log/nginx/access.log (deleted)
worker   1842 app     5w   REG  253,1 104857600     0 9911 /tmp/job-output.log (deleted)
::exit-code::0

YouTube Short

Deleted logs still using disk?

If space did not return after deleting a huge file, a process may still hold it open. lsof +L1 shows it.

experiments

A/B tests to run

Metric: save_rate

A: Deleted file still uses disk.

B: Find what holds deleted logs open.