During an after-hours incident you discover that a production web server's root filesystem is completely full. The command df -h / shows 100 % usage on the 20 GB ext4 partition, but du -xsh / totals only about 7 GB. You have already removed several large log files, yet the space is not reclaimed and applications are still failing to write. Which single command will most quickly reveal the process that is preventing the space from being freed so you can resolve the issue?
The large gap between df and du indicates that one or more files were deleted but remain open by a running process; their blocks stay allocated until the file descriptors are closed. The command lsof +L1 / (or equivalently lsof | grep '(deleted)') lists every open file with fewer than one hard link-exactly those deleted files still held open-along with the PID of the process using them. Once the offending process is restarted or terminated, the space is released.
Reducing the reserved-block percentage with tune2fs, running fsck, or searching for large existing files with find does not reveal unlinked files that remain open, so those options do not directly identify the root cause.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does the `lsof +L1` command do?
Open an interactive chat with Bash
Why does `df` and `du` show different disk usage amounts?
Open an interactive chat with Bash
What happens when a file is deleted but still held open by a process?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Troubleshooting
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access