How to check deleted files still open in Linux

Deleted log, cache, or temporary files can keep consuming disk blocks after their pathname disappears. Checking for deleted files that are still open shows which running process still owns that space so the missing capacity can be traced without guessing.

On Linux, removing a pathname unlinks the directory entry, but the kernel keeps the inode and its blocks until the last open file descriptor closes. The lsof selector +L1 lists open files whose link count has dropped to zero, and the combined form +aL1 can narrow that search to one mounted filesystem when the problem is isolated to a specific mount.

Most systems require sudo to inspect every process, and minimal images do not always install lsof by default. The checks below rely on the normal /proc descriptor view, so container boundaries, network filesystems, and restricted namespaces can hide handles that would be visible on the host itself.

1. List deleted files that are still open.

   $ sudo lsof +L1
   COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NLINK   NODE NAME
   python3 4271 root    3w   REG  0,253 67108864     0 421988 /var/log/demo/app.log (deleted)

   The (deleted) marker shows that the pathname is gone but the process still holds the file descriptor open.

2. Identify the affected filesystem when a specific path is under pressure.

   $ df -h /var/log/demo
   Filesystem      Size  Used Avail Use% Mounted on
   /dev/vda1        59G   44G   13G  79% /

   Run df against the deleted file's former directory, such as /var/log/demo or /home/app/logs. Reuse the Mounted on value from this step in the next command.

3. Rerun the check on that filesystem for a shorter result.

   $ sudo lsof +aL1 /
   COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
   python3 4271 root    3w   REG  0,253 67108864     0 421988 /var/log/demo/app.log (deleted)

   The +aL1 form combines the zero-link filter with the filesystem path so the result stays focused on one mount.

4. Inspect the owning process before deciding how to release the space.

   $ ps -fp 4271
   UID          PID    PPID  C STIME TTY          TIME CMD
   root        4271       1  0 09:18 ?        00:00:00 python3 /opt/demo/app.py

   The command line shows whether the deleted file belongs to a service, a worker, or a one-off script.

5. Confirm the deleted descriptor under /proc so the exact handle is known.

   $ sudo ls -l /proc/4271/fd/3
   l-wx------ 1 root root 64 Apr 14 09:18 /proc/4271/fd/3 -> /var/log/demo/app.log (deleted)

   The descriptor number comes from the FD column in the lsof output.

   Related: How to manage a Linux service with systemctl
   Related: How to kill a process in Linux