Linux Commands / IT Support Guides
Identify a file owner with lsof
An application can hold a file open after rotation or keep a port occupied after a partial shutdown. Inspect ownership before deleting files or killing processes.
Environment and inputs: Linux · Bash-compatible shell; package and service names vary by distribution
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
lsof /var/log/app/app.logHow to read the result
The output associates the selected path with processes and file descriptors visible to your account. Missing results can reflect permissions or a different inode after rotation.
What to do next
Replace the example path and compare the process with the application's rotation or shutdown behavior. Coordinate any restart with the service owner and retest disk usage afterward.
Before you make a change
Install lsof through the approved package process if unavailable. Do not truncate an open application file without understanding the application's write behavior.