Home > Linux > Linux: remove files that got deleted while written – or how to lose track of files eating up your disk space

Linux: remove files that got deleted while written – or how to lose track of files eating up your disk space

Just stumbled across why you should not simply delete files such as:

/var/log/syslog
/var/log/kern.log

These files get written permanently, therefore are opened. The application writing to the file has an according file handle, therefore deleting the file using

rm /var/log/syslog
rm /var/log/kern.log

deletes the representation of the data in the file system, not the data itself. As the file handle used by the application writing to these files uses the inode, not the file name, the file continues to exist. Therefore you do not free disk space – but lose track of the files eating up your space, if you don’t recognize the mistake. To recreate the access to the file via the file system simply recreate the files and restore their ownership:

touch /var/log/syslog
chown syslog:adm /var/log/syslog
touch /var/log/kern.log
chown syslog:adm /var/log/kern.log

You should see the files in the file system again then. If they stay empty (and you did not free any disk size), try:

reload rsyslog

Then you should see the log growing again – and your disk will finally be less occupied.

Categories: Linux Tags: , , , , ,
  1. No comments yet.
  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: