11

I have java(yeah java...) application running on CentOS 7. After a while, there are many "deleted" files that bother me.

for deleted files used(not the issue):

lsof | grep "(deleted)"

I found them in /proc/pid/fd/... and my question is how can I kill/delete them without killing the process(process have to run 24/7).

I saw on google that I can use gdb tool, but I don't know how to use it. Can you please help me(just to write step-by-step manual)?

I will love to hear some other suggestions if you have.

DavidPostill
  • 153,128
  • 77
  • 353
  • 394
igor
  • 423
  • 1
  • 11
  • 25
  • @user20574 If another program was writing to the file, and it lost the handle to it, it's obvious that would cause a file corruption. – Glimpse Jul 27 '18 at 00:05
  • 1
    @Glimpse well yes, but only to the file you force-closed. It's not obvious that it will also corrupt *other files at random*. – user253751 Jul 27 '18 at 02:14
  • I am more curious about how to NOT make this happen in the first place. That is to ask: how to delete files properly in Java so they don't end up appearing as "deleted" but "open" files that you need to "clean up" separately. – jyu Nov 06 '19 at 23:32

2 Answers2

19

use lsof -p $PID and find the file descriptor (4th column)

root@blah:~# lsof -p 1737 | grep "(deleted)" apache2 1737 root 6w REG 0,25 0 207401 (deleted)/var/log/apache2/other_vhosts_access.log

4th column is 6w, meaning file descriptor 6 and it was opened for writing (w).

Then:

gdb -p $PID p close($FD)

eg:

gdb -p 1737 ..... (gdb) p close(6) $1 = 0 ... Quit anyway? (y or n) y Detaching from program: /usr/lib/apache2/mpm-prefork/apache2, process 1737

damolp
  • 336
  • 1
  • 3
  • THANKS, finally a good working simple answer!! btw, all my processes has 'x'u in 4th column. What does "u" means? – igor Aug 30 '15 at 06:28
  • 1
    `u` means that the file descriptor is opened reading and writing – damolp Aug 31 '15 at 01:34
  • `'close' has unknown return type; cast the call to its declared return type` comes up after `p close(x)`. Any idea how to do it? (p.s. running on CentOS 8) – Sam Sirry Mar 04 '23 at 02:06
1

Use the following command to find the deleted files file descriptors and you may truncate them afterwards

find /proc/ -mindepth 3 -maxdepth 3 \ -regex '/proc/[1-9][0-9]/fd/[1-9][0-9]' -type l -lname '*(deleted)' \ -printf '%p\n %l\n' 2>/dev/null

kashminder
  • 169
  • 1
  • 6
  • But if the program still has the file descriptor opened, it may continue writing on these, growing disk space utilization – Marco Marsala Jan 03 '21 at 01:00