How to check deleted files still open in Linux

A filesystem can stay full after a large log, cache, or temporary file has been removed when a running process still has that file open. Checking deleted-but-open files identifies the process, file descriptor, size, and former pathname so the missing disk space can be traced to a concrete handle before anything is restarted or killed.

On Linux, deleting a pathname unlinks the directory entry, but the kernel keeps the inode and its disk blocks until the last file descriptor closes. The lsof selector +L1 lists open files whose link count is below one, which exposes unlinked files, and +aL1 combines that filter with a filesystem path when the pressure is isolated to one mount.

Run the check with sudo when system processes may own the deleted file, and install lsof first on minimal hosts that do not include it. Confirming with the /proc/<pid>/fd descriptor view depends on process-namespace access, so container boundaries, restricted process namespaces, and some network filesystems can hide handles that are visible only from the owning host or namespace.

Related: How to investigate low disk space in Linux
Related: How to check log directory sizes in Linux

Steps to check deleted files still open with lsof in Linux:

  1. List deleted files that are still open. 
    $ sudo lsof +L1
COMMAND  PID USER FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
python3 2921 root 3w   REG   0,64 67108864     0 2752578 /var/log/example/app.log (deleted)

    NLINK value 0 and the (deleted) marker show that the pathname is gone while the process still holds the file descriptor open. No output means lsof did not find a deleted-open file in the visible process namespace.

  2. Identify the filesystem that owns the former path. 
    $ df -h /var/log/example
Filesystem      Size  Used Avail Use% Mounted on
overlay         118G  8.9G  103G   8% /

    Use the deleted file's former directory, such as /var/log/example or /home/app/logs. Reuse the Mounted on value from this output when narrowing the lsof check.

  3. Rerun the check on that filesystem. 
    $ sudo lsof +aL1 /
COMMAND  PID USER FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
python3 2921 root 3w   REG   0,64 67108864     0 2752578 /var/log/example/app.log (deleted)

    The +aL1 form keeps only zero-link files on the specified filesystem, which reduces noise on hosts with several busy mounts.

  4. Inspect the owning process command line. 
    $ ps -fp 2921
UID          PID    PPID  C STIME TTY          TIME CMD
root        2921       1  0 02:22 ?        00:00:00 python3 /opt/example/app.py

    The command line shows whether the deleted file belongs to a managed service, a background worker, or a one-off script.

  5. Confirm the exact deleted descriptor under /proc. 
    $ sudo ls -l /proc/2921/fd/3
l-wx------ 1 root root 64 Jun 13 02:22 /proc/2921/fd/3 -> /var/log/example/app.log (deleted)

    The descriptor number comes from the FD column in the lsof output. Disk blocks are released when the process closes this descriptor, usually through a service restart, log reopen, or process exit.

    Related: How to manage a Linux service with systemctl
    Related: How to kill a process in Linux