12

I have java(yeah java...) application running on CentOS 7. After a while, there are many "deleted" files that bother me.

for deleted files used(not the issue):

lsof | grep "(deleted)"

I found them in /proc/pid/fd/... and my question is how can I kill/delete them without killing the process(process have to run 24/7).

I saw on google that I can use gdb tool, but I don't know how to use it. Can you please help me(just to write step-by-step manual)?

I will love to hear some other suggestions if you have.

3
  • @user20574 If another program was writing to the file, and it lost the handle to it, it's obvious that would cause a file corruption.
    – Glimpse
    Jul 27, 2018 at 0:05
  • 1
    @Glimpse well yes, but only to the file you force-closed. It's not obvious that it will also corrupt other files at random.
    – user253751
    Jul 27, 2018 at 2:14
  • I am more curious about how to NOT make this happen in the first place. That is to ask: how to delete files properly in Java so they don't end up appearing as "deleted" but "open" files that you need to "clean up" separately.
    – jyu
    Nov 6, 2019 at 23:32

2 Answers 2

19

use lsof -p $PID and find the file descriptor (4th column)

root@blah:~# lsof -p 1737 | grep "(deleted)" apache2 1737 root 6w REG 0,25 0 207401 (deleted)/var/log/apache2/other_vhosts_access.log

4th column is 6w, meaning file descriptor 6 and it was opened for writing (w).

Then:

gdb -p $PID p close($FD)

eg:

gdb -p 1737 ..... (gdb) p close(6) $1 = 0 ... Quit anyway? (y or n) y Detaching from program: /usr/lib/apache2/mpm-prefork/apache2, process 1737

3
  • THANKS, finally a good working simple answer!! btw, all my processes has 'x'u in 4th column. What does "u" means?
    – igor
    Aug 30, 2015 at 6:28
  • 1
    u means that the file descriptor is opened reading and writing
    – damolp
    Aug 31, 2015 at 1:34
  • 'close' has unknown return type; cast the call to its declared return type comes up after p close(x). Any idea how to do it? (p.s. running on CentOS 8)
    – Sam Sirry
    Mar 4, 2023 at 2:06
1

Use the following command to find the deleted files file descriptors and you may truncate them afterwards

find /proc/ -mindepth 3 -maxdepth 3 \ -regex '/proc/[1-9][0-9]/fd/[1-9][0-9]' -type l -lname '*(deleted)' \ -printf '%p\n %l\n' 2>/dev/null

1
  • But if the program still has the file descriptor opened, it may continue writing on these, growing disk space utilization Jan 3, 2021 at 1:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .