How to find deleted files still open in Linux

A filesystem can report low free space even after large files are deleted when a process still has the deleted file open. The data remains allocated until the last file descriptor is closed, so reclaiming space requires identifying the owning process rather than searching the directory tree.

On Linux, deleting a file unlinks its directory entry, but the file’s blocks are only freed when nothing references the inode anymore. Tools like du walk filenames and can miss unlinked files, while df reports allocated blocks, so a mismatch often points to deleted-but-open files. The lsof utility exposes those open handles by showing paths tagged with (deleted) and the associated process IDs.

Root privileges are often required to see every process’ open files, and the list may include both rotated logs and short-lived runtime files. Releasing disk space typically means restarting a service or stopping the process that holds the open handle so the descriptor closes. Restarting the wrong PID can disrupt production traffic, so confirm process ownership before applying changes.

1. List deleted files held open by processes.

   $ sudo lsof +L1 | head -n 5
   COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NLINK   NODE NAME
   python3 27361 root    3w   REG   0,64       12     0 362952 /var/log/demo/demo.log (deleted)

   Entries ending with (deleted) and NLINK of 0 indicate unlinked files still consuming space; SIZE/OFF shows the size still held.

2. Inspect the owning process command line for the selected PID.

   $ ps -fp 27361
   UID        PID  PPID  C STIME TTY          TIME CMD
   root     27361 27352  0 08:34 ?        00:00:00 python3 -

   A PPID of 1 often indicates a daemon-managed process.

3. Review open file descriptors for the process under /proc.

   $ sudo ls -l /proc/27361/fd | head -n 5
   total 0
   lr-x------ 1 root root 64 Jan 14 08:34 0 -> pipe:[2546449]
   l-wx------ 1 root root 64 Jan 14 08:34 1 -> pipe:[2549954]
   l-wx------ 1 root root 64 Jan 14 08:34 2 -> pipe:[2549955]
   l-wx------ 1 root root 64 Jan 14 08:34 3 -> /var/log/demo/demo.log (deleted)

   Symlinks in /proc/<PID>/fd map each open descriptor to its target path.

4. Restart the owning service to close the deleted file descriptors.

   $ sudo systemctl restart service-name.service

   Restarting a service can terminate active connections and interrupt workloads.

   Related: How to manage a Linux service with systemctl

5. Search for the deleted path again to confirm the handle is released.

   $ sudo lsof +L1 | grep -F '/var/log/demo/demo.log (deleted)'
   python3 27361 root    3w   REG   0,64       12     0 362952 /var/log/demo/demo.log (deleted)

   No output indicates the deleted handle is no longer open.

6. Confirm free space is reclaimed on the filesystem that contained the deleted file.

   $ df -h /var/log
   Filesystem      Size  Used Avail Use% Mounted on
   overlay         1.8T   17G  1.7T   1% /