Find Deleted Files Still Holding Disk Space (lsof +L1)
When df says full but du disagrees, open-but-deleted files are the usual culprit; lsof +L1 lists them with the process holding each.
01Command
$ sudo lsof +L102What it does
On Linux, deleting a file only unlinks it — the space is released when the last process with it open exits, so a log rotated out from under a running daemon can pin gigabytes. `sudo lsof +L1 | sort -k7 -n -r` sorts the biggest first using the SIZE/OFF column. The fix is to restart or gracefully reload the holding process (e.g. `systemctl reload rsyslog`); truncating via the /proc/PID/fd/N link is a last resort.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- lsof(8) - Linux manual pageEvidence: The +L1 option selects files with a link count less than one, i.e. open files that have been unlinked (deleted).
Last verified: 2026-09-17 · Category: System & Settings
06Related solutions
One command that prints every interface with its state and IPv4/IPv6 addresses in a short table — the modern, memorable replacement for digging through `ifconfig` or the verbose `ip addr` output.
The routing table is the first thing to check when traffic leaves the wrong interface or the gateway seems dead — and `ip route show` is the quick, modern way to read it.
The fastest way to answer 'is the firewall blocking me?' — netcat in scan mode attempts one TCP connection and prints whether it succeeded.