208

I tried to rm -rf a folder, and got "device or resource busy".

In Windows, I would have used LockHunter to resolve this. What's the linux equivalent? (Please give as answer a simple "unlock this" method, and not complete articles like this one. Although they're useful, I'm currently interested in just ASimpleMethodThatWorks™)

  • 4
    Thanks this was handy - I was coming from Linux to Windows, was looking for the equivalent of lsof - LockHunter. – Sonia Hamilton Sep 4 '13 at 2:28
  • 3
    What the hell? Unix does not prevent you from deleting open files like Windows does. This is why you can delete your whole system by running rm -rf /... it will happily delete every single file, including /bin/rm. – psusi Oct 10 '14 at 15:35
  • 1
    @psusi, that is incorrect. You either have a bad source of information or are just making stuff up. Linux, like Windows, has file and device locking. It's kind of broken, though. 0pointer.de/blog/projects/locking.html – foobarbecue Jan 10 '15 at 1:05
  • 1
    @foobarbecue, normally those are only advisory locks and the man page at least seems to indicate they are only for read/write, not unlink. – psusi Jan 10 '15 at 23:34
213

The tool you want is lsof, which stands for list open files.

It has a lot of options, so check the man page, but if you want to see all open files under a directory:

lsof +D /path

That will recurse through the filesystem under /path, so beware doing it on large directory trees.

Once you know which processes have files open, you can exit those apps, or kill them with the kill(1) command.

  • 39
    What if there were no results? – marines Feb 4 '14 at 15:04
  • 19
    @marines: Check if another filesystem is mounted beneath /path. That is one cause of hidden "open files". – camh Feb 5 '14 at 9:16
  • 1
    lsof command directly to the path does not work. So basically need to go in the path location and then run lsof busy_file then kill all the process – J4cK Jul 4 '16 at 11:56
  • 4
    lsof seems to do nothing for me: lsof storage/logs/laravel.log returned nothing, and so did lsof +D storage/logs/. umount responded with not mounted. – Ryan May 25 '18 at 1:01
  • 1
    Just to elaborate on @camh answer: Use mount | grep <path>. That shows any /dev/<abc> might be mounted on the the <path>. Use sudo umount -lf /dev/<abc> and then try to remove <path>. Works for me. Thanks @camh – Vikas Goel Jun 27 '18 at 23:33
99

sometimes it's the result of mounting issues, so I'd unmount the filesystem or directory you're trying to remove:

umount /path

  • 4
    It's a quarter to four. Thanks man, you saved my night. Hilarious. On single line - so much wasted time -.-' – Aiyion.Prime Jun 23 '15 at 1:48
  • 1
    my problem was a log directory mounted as /dev/mapper/vg00-root – Spikolynn Dec 27 '15 at 21:56
  • 1
    Helped me get out of a similar jam on winders. – Jon May 9 '16 at 17:44
  • 1
    in my case, Jenkins didn't unmount chroot dir after task abort – zarkone Nov 3 '16 at 3:46
  • 1
    in my case, unmount with ubuntu desktop worked!! THanks – JRichardsz Jan 11 '18 at 14:14
14

I use fuser for this kind of thing. It will list which process is using a file or files within a mount.

  • fuser helps only in the specific case when you want to unmount a filesystem. Here the problem is to find what's using a specific file. – Gilles Apr 13 '11 at 19:09
  • @Gilles: Also works for files. – BillThor Apr 14 '11 at 0:36
  • Sorry, wrong objection: fuser doesn't help here because the problem is to find all the open files in a directory tree. You can tell lsof to show all files and filter, or make it recurse; fuser has no such mode and needs to be invoked on every file. – Gilles Apr 14 '11 at 7:57
  • @Giles: fuser works will lists. Try fuser /var/log/*, if any logs are open it will tell which ones and who has it open. If a simple wildcard, won't work, find with or without xargs will do the job. – BillThor Apr 14 '11 at 17:23
  • 1
    lsof was not in my path while fuser was, allowing me to find the offending process ID to kill, so +1+thanks. – stevesliva Oct 13 '15 at 19:48
12

Here is the solution:

  1. Go into the directory and type ls -a
  2. You will find a .xyz file
  3. vi .xyz and look into what is the content of the file
  4. ps -ef | grep username
  5. You will see the .xyz content in the 8th column (last row)
  6. kill -9 job_ids - where job_ids is the value of the 2nd column of corresponding error caused content in the 8th column
  7. Now try to delete the folder or file.
  • 3
    It would be interesting to know where those mysterious files are coming from. – John WH Smith Aug 12 '14 at 20:59
7

I had this same issue, built a one-liner starting with @camh recommendation:

lsof +D ./ | awk '{print $2}' | tail -n +2 | xargs kill -9

The awk command grabs the PIDS. The tail command gets rid of the pesky first entry: "PID". I used -9 on kill, others might have safer options.

  • 1
    To make it more universal you can use ./ for current directory instead of log/ – user2589273 Nov 22 '17 at 17:26
  • Good point, @user2589273. Updated. – Choylton B. Higginbottom Nov 22 '17 at 18:00
5

I had this problem when an automated test created a ramdisk. The commands suggested in the other answers, lsof and fuser, were of no help. After the tests I tried to unmount it and then delete the folder. I was really confused for ages because I couldn't get rid of it -- I kept getting "Device or resource busy"!

By accident I found out how to get rid of a ramdisk. I had to unmount it the same number of times that I had run the mount command, i.e. sudo umount path

Due to the fact that it was created using automated testing, it got mounted many times, hence why I couldn't get rid of it by simply unmounting it once after the tests. So, after I manually unmounted it lots of times it finally became a regular folder again and I could delete it.

Hopefully this can help someone else who comes across this problem!

4

I experience this frequently on servers that have NFS network file systems. I am assuming it has something to do with the filesystem, since the files are typically named like .nfs000000123089abcxyz.

My typical solution is to rename or move the parent directory of the file, then come back later in a day or two and the file will have been removed automatically, at which point I am free to delete the directory.

This typically happens in directories where I am installing or compiling software libraries.

3

Riffing off of Prabhat's question above, I had this issue in macos high sierra when I stranded an encfs process, rebooting solved it, but this

ps -ef | grep name-of-busy-dir

Showed me the process and the PID (column two).

sudo kill -15 pid-here

fixed it.

2

If you have the server accessible, Try

Deleting that dir from the server

Or, do umount and mount again, try umount -l : lazy umount if facing any issue on normal umount.

I too had this problem where

lsof +D path : gives no output

ps -ef : gives no relevant information

protected by Community Jun 26 '18 at 16:37

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.