Ubuntu – lsof shows tmp growing file marked as deleted

cronlog-fileslsoftmpUbuntu

I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file.

I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up my storage.

After the change, I continued getting the same "high IO" warnings and the server storage was increasing temporarily and then going back to previous size.The original log file was empty.

I found one file using lsof -p <PID of cron> that was getting bigger by the second.

sh      25626 root   10u   REG  202,1 21280244045     773 /tmp/tmpfZ14vFH (deleted)

This file is marked as deleted and I cannot find it in the /tmp directory.

Please provide some insight on this.

Is the OS writing the stderr in a tempprary file while the process is running?

Best Answer

You must cycle (start/stop) the process that has a hold of the file handle.

Check with ps -ef |grep 25626 as a beginning point to find the process that's holding it and if possible, cycle it. It will allow the file handle to release and the disk space will be cleared.

I know you've already done this (found that sh is the process in question), but here is my go-to command in my notes (likely found on stack exchange in the past) for finding these mystery deleted files: lsof | grep deleted | numfmt --field=7 --to=iec | head

Related Topic