“lsof” shows a file as (deleted) but I can still see it in file system

故事扮演 提交于 2020-05-25 08:01:40

问题


in Linux 2.6.27:

From "lsof" output I see a process holding open fd with a (deleted) file. The strange thing is that I can still see the file in the file system using "ls". Why is that?

thanks.


回答1:


When a file is deleted it would not been seen on the file system. However, it is quite possible another file with the same file name is created on the same location.

You can check the node number shown in lsof and ls -i to check whether they are really the same file.




回答2:


The file is not deleted as long as some process has the file open. When a file is closed, the kernel first checks the count of the number of process that have the file open. If this count has reached 0, the kernel then checks the link count; if it is 0, the file's contents are deleted.

To quote from man unlink:

If the name was the last link to a file but any processes still have the file open the file will remain in existence until the last file descriptor referring to it is closed.



来源:https://stackoverflow.com/questions/18200701/lsof-shows-a-file-as-deleted-but-i-can-still-see-it-in-file-system

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!