Linux Server / Filesystems, LVM & Recovery
Find deleted-but-open files when df and directory totals disagree
A removed log can continue consuming disk blocks while a process holds it open. Directory scans then fail to account for all allocated space.
Environment and inputs: Linux server baseline · Ubuntu 24.04 LTS / RHEL 9-style systems. Use the specified distribution, init system and installed tool; service names, privileges and supported options can differ.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
lsof +L1Read the result
With appropriate process visibility, this lists open files with link counts below one. It can produce substantial or sensitive process-path output on a busy host.
Resolve and verify
Map a large entry to its owning service and log lifecycle, then coordinate a supported reopen or restart. Verify free space and log output afterward.
Before changing production
Do not kill arbitrary processes or truncate unknown descriptors to recover space. Protect in-flight writes and application consistency.