现象

文件删除后，磁盘空间未释放。

排查

使用lsof命令查看哪些文件已经被删除，而系统扔持有该文件的句柄未释放(其他进程中正在使用该文件)。

lsof | grep deleted

输出

java 89018 root 125w REG 0,22 /logs/log-info.log (deleted)

查看进程为89018的125号文件描述符，还保留着原始文件的内容，清空之。

> /proc/89018/fd/125

备注

对于deleted文件句柄的释放，目前已知的解决方案是重启应用。

lsof字段含义

使用man lsof查看更多字段。

FD is the File Descriptor number of the file or:

cwd current working directory;

Lnn library references (AIX);

err FD information error (see NAME column);

jld jail directory (FreeBSD);

ltx shared library text (code and data);

Mxx hex memory-mapped type number xx.

m86 DOS Merge mapped file;

mem memory-mapped file;

mmap memory-mapped device;

pd parent directory;

rtd root directory;

tr kernel trace file (OpenBSD);

txt program text (code and data);

v86 VP/ix mapped file;

FD is followed by one of these characters, describing the mode under which the file is open:

r for read access;

w for write access;

u for read and write access;

space if mode unknown and no lock

character follows;

‘-’ if mode unknown and lock

character follows.

The mode character is followed by one of these lock characters, describing the type of lock applied to the file:

N for a Solaris NFS lock of unknown type;

r for read lock on part of the file;

R for a read lock on the entire file;

w for a write lock on part of the file;

W for a write lock on the entire file;

u for a read and write lock of any length;

U for a lock of unknown type;

x for an SCO OpenServer Xenix lock on part of the file;

X for an SCO OpenServer Xenix lock on the entire file;

space if there is no lock.

See the LOCKS section for more information on the lock information character.

The FD column contents constitutes a single field for parsing in post-processing scripts.