How to Delete Log Files Recursively and Free Disk Space on Linux

During Linux interview sessions, candidates are often asked how to delete all log files in a directory. The naive answer rm *.log only removes files in the current folder and fails for nested directories. A more robust solution uses find to search recursively and delete matching files: find -name "*.log" -exec rm -f {} \; Variants such as -delete, piping to xargs, or using ls -R | grep are also valid.

In practice, a shared development machine can fill up with logs, so a cron job can automate cleanup. For example, the following entry removes log files larger than 100 MiB every day at 04:00:

0 4 * * * find /home/ -type f -name "*.log*" -size +100M -exec bash -c "echo -n > '{}'" \;

This command empties the file via redirection instead of deleting it, avoiding issues with processes that may still have the file open.

Why Deleting a File May Not Free Space

If a process keeps a file descriptor open, the inode remains in use and the disk space is not reclaimed until the process closes the file or exits. The article demonstrates this with a Python process holding a.txt open, then deleting the file and inspecting /proc/<em>PID</em>/fd to see the file marked as (deleted) but still occupying space.

Finding and Releasing Deleted‑but‑Open Files

Use lsof to list open files and filter for those marked deleted: sudo lsof | grep deleted After identifying the offending process (e.g., a long‑running nohup.out), terminating it releases the space. On production services, killing the process may not be acceptable, so other strategies are needed.

Log Rotation with logrotate

Services like nginx rely on logrotate to rename current logs, send a SIGHUP signal, and let the daemon reopen a fresh file. This ensures the old file can be safely removed after the process switches to the new one.

Soft Links vs. Hard Links

A soft link stores the target path, while a hard link shares the same inode. The article shows how to create and inspect both types using ln -s and ln, and how stat reveals inode numbers and link counts.

Advanced Cleanup Techniques

For append‑only logs, truncating the file via redirection works: echo -n > /proc/2390/fd/3 For more aggressive actions, attaching gdb to a process and calling ftruncate(fd, 0) can truncate the file, though this is risky and should be used with caution.

Key Takeaways

Use find for recursive file selection and deletion.

Soft links store paths; hard links share inodes.

Deleting a file that is still open does not free space until the descriptor is closed. lsof is essential for diagnosing open‑file issues.