I have an old log that stays in (deleted) state, and after applying

> /proc/'pid'/fd/4 the space is not reclaimed.

In fact, the size of file is zeroed, but the space is still used ? Have I forgotten something ? Do I have to perform unlink of some sort ?

lr-x------ 1 root root 64 Mar 10  16:11 4 -> /var/app/logs/app.log (deleted)
appl  'pid' appl    4r   REG  253,2         **0** 6193157 /var/app/logs/app.log (deleted)

In fact the space is reclaimed by the filesystem, but the size of the file is only temporarily reduced to 0 until the next write by the process that still has the file open. At that point the size is increased to the previous size, plus the newly written data, but you now have a sparse file, where the start of the file is full of notional zeroes, which take no space on the disc.

You can see this effect with a simple test. Create a large file that is slowly updated every 10 seconds:

$ { dd count=1k if=/dev/zero; while sleep 10;do echo hi; done; } >/tmp/big &
  [2] 1050
$ pid=$!

Check its size and the disc space used:

$ ls -ls /tmp/big
  516 -rw-r--r-- 1 meuh users 524516 Aug 15 15:58 /tmp/big
$ du -a /tmp/big
  516     /tmp/big
$ df /tmp
  Filesystem     1K-blocks  Used Available Use% Mounted on
  tmpfs            1966228  2924   1963304   1% /tmp

The file is 524516 bytes, 516 blocks, and the filesystem has used 2924 blocks. Now use your > command to truncate the file, and immediately check the size:

$ > /proc/$pid/fd/1; ls -ls /tmp/big
  0 -rw-r--r-- 1 meuh users 0 Aug 15 15:59 /tmp/big

It is zero. After 10 seconds check again:

$ ls -ls /tmp/big
  4 -rw-r--r-- 1 meuh users 524534 Aug 15 15:59 /tmp/big
$ df /tmp
  Filesystem     1K-blocks  Used Available Use% Mounted on
  tmpfs            1966228  2416   1963812   1% /tmp

As you can see the space has been reclaimed by the disc (from 2924to 2416 used), but the size of the file is as it was before, plus a bit, but the number of blocks it occupies (4, the first number of the ls -ls) is small, hence the sparseness. lsof -p $pid also shows the offset, not the size.


The space isn't reclaimed because there is still an open file (and likely being appended on the end by an active process).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.