"lsof" shows a file as (deleted) but I can still see it in file system

linux lsof
user1783732 picture user1783732 · Aug 13, 2013 · Viewed 25.2k times · Source

in Linux 2.6.27:

From "lsof" output I see a process holding open fd with a (deleted) file. The strange thing is that I can still see the file in the file system using "ls". Why is that?

thanks.

Answer

fefe picture fefe · Nov 20, 2013

When a file is deleted it would not been seen on the file system. However, it is quite possible another file with the same file name is created on the same location.

You can check the node number shown in lsof and ls -i to check whether they are really the same file.

Related questions

Seeing too many lsof can't identify protocol

I have a Java process/app. When I run /usr/sbin/lsof -p on that java process, I see a lot of "can't identify protocol". Also, interestingly, File descriptors(FDs) are increasing at a very steady rate. And those FDs …

Read More
How many open files for each process running for a specific user in Linux

Running Apache and Jboss on Linux, sometimes my server halts unexpectedly saying that the problem was Too Many Open Files. I know that we might set a higher limit for nproc and nofile at /etc/security/limits.conf to fix …

Read More
What does the FD column of pipes listed by lsof mean?

I'm using the following command to get a list of pipes: lsof | grep PIPE I want to know what the values of the FD column mean (the 5th one http://i.imgur.com/KHczptf.png). I think that r and …

Read More