I want to know if kill the delete process , can help to clean the memory cache sometimes we get from lsof many deleted files so does killing them can give more available memory ?


lsof | grep delete
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/42/gvfs
      Output information may be incomplete.

cupsd      1619                  root   10r      REG              253,0      2979   38250477 /etc/passwd+ (deleted)
gnome-set  5731                   gdm   14r      REG              253,0     65536   51102558 /etc/pki/nssdb/cert8.db;5c644c01 (deleted)
gnome-set  5731                   gdm   16r      REG              253,0     16384   51197440 /etc/pki/nssdb/key3.db;5c644c01 (deleted)
pool       5731  5795             gdm   14r      REG              253,0     65536   51102558 /etc/pki/nssdb/cert8.db;5c644c01 (deleted)

kill 1619

we are worried if process that are delete are consume memory

also we can see the follwing:

lsof | grep deleted | wc -l 
  • This seems a XY problem. Would you mind editing the question with what is worrying you? – Rui F Ribeiro Mar 7 at 10:25
  • I edit my equation , is it ok? – yael Mar 7 at 10:28
  • Please add the output of free, vmstat, lsof | grep deleted | wc -l – Rui F Ribeiro Mar 7 at 10:31
  • from lsof | grep deleted | wc -l , we get 3421 – yael Mar 7 at 10:32
  • 1
    What do you mean by “delete process” and “process that are delete”? The processes aren’t deleted, files that they have open are. – Stephen Kitt Mar 7 at 10:33

Often processes expressly create and open files and delete them directly so that the file can be used more securely, and to ensure that the file is removed when the process ends.

In short, this is a feature; especially with the files you show in your question. Killing these processes will disturb the workings of your system.

There are cases where having deleted files still opened could be a bug (e.g. a process is writing to a log file, but the log file is compressed and deleted without signalling the process to reopen the log file). You can truncate such files via the /proc/ filesystem: find the file descriptor number with lsof as shown above, and then do > /proc/12345/fd/123 to truncate the file (12345 is process ID, 123 is the file descriptor number. However this is very seldomly necessary.

Note that the processes aren't deleted, only the directory entry referencing those files have been removed.

  • lets say we have available 1G memory and we see more then 3000 deleted files , so in this case we not have a choice ? am I right ? – yael Mar 7 at 10:37
  • 1
    Deleted files have nothing to do with available memory, only available disk space. If each deleted file is >0 <4kB in size, then you will save 12MB of disk space (assuming 4kB block size). – wurtel Mar 7 at 10:48
  • I agree with @wurtel here, the main worry is disk space. – Rui F Ribeiro Mar 7 at 10:52

Depending on the software/solutions you are using, you have to define a known/acceptable baseline.

I would not obsess with deleted files still open/present on the system if they are not growing at a significant rate over time. Now, if you have significant deviations from the normal baseline of a system/VM, that maybe something to worry about.

We recently found out some systems common to a software supplier, where we had deviations to the baseline on the order of 20-50K deleted files; an lsof was taking like 5 minutes to complete, and we were running out of disk.

Eventually, we found out the supplier must had developed some Java routines where he was opening temp files, and deleting them without closing them. We filed a bug with the supplier, pinponting the suspect files, and he corrected the code. We also pinpointed to both the customer and supplier the solution might hit a limit of open files in Linux with bigger data partitions.

  • lets say we have available 1G memory and we see more then 3000 deleted files , so in this case we not have a choice ? am I right ? – yael Mar 7 at 10:46
  • It might depend more on the software/the environment/the VM that the open files per se. You cannot give a definite answer/recipe on that. I would restart the process and follow the situation. 3K might be an acceptable number if it is constant over time, it all depends on several particular and broad factors. Some common sense might be needed to evaluate the situation. – Rui F Ribeiro Mar 7 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.