Today I had a name-server stop resolving DNS due to the /var directory being full from the named.run cache build up. I tried removing all the files using:

rm -rf name*

However, although running ls showed now files in the directory "data" running df -h still showed 100% use on /var. In the end I rebooted the machine and this resolved the problem but I am a little confused why this did not delete the files. (Obviously rebooting is not something I want to do every time even though we have failover.) Does anyone know the reason?

  • 3
    Deleted files that still have at least one open file descriptor referring to them in a running process will retain all their data, and will continue to be read from and written to by any processes that have access to the descriptor. Some workarounds are suggested in unix.stackexchange.com/a/68532/49439 . Most direct thing to do is, if you can, kill the processes that are holding the files open. Commented Apr 25, 2014 at 0:20
  • Yep, that makes sense. Thanks Mark!
    – Aliasu
    Commented Apr 25, 2014 at 0:30
  • 1
    @MarkPlotnick Why don't you make that an answer? Commented Apr 25, 2014 at 2:02
  • To check before deleting a file, fuser -v <filename> will show process info currently holding a file descriptor open on a file, (or socket).
    – X Tian
    Commented Apr 25, 2014 at 4:14
  • named doesn't normally keep named.run open; it just writes it and closes it. Maybe someone started running less named.run and hasn't exited it. Try using ps axww | grep named.run to see if you can find it.
    – Barmar
    Commented Apr 26, 2014 at 6:37

2 Answers 2


Check the output of:

find /proc/*/fd -ls | grep  '(deleted)'

If you find your files listed here, kill the process which has an open file descriptor (or file handle). That should do the trick!


Restarting named service or doing rndc reload should solve that problem.

Not the answer you're looking for? Browse other questions tagged .