How to Locate and Release Disk Space from Deleted Open Files on Linux

In routine Linux operations, disk‑space alerts may reveal a mismatch between df (showing high usage) and du (showing lower usage). If df -i indicates that inode usage is normal, the most likely cause is a large file that has been removed but is still referenced by a running process.

Why the space is not released

When a process keeps an open file descriptor to a file that has been deleted, the file's data blocks remain allocated until the process terminates or closes the descriptor. Consequently, the occupied space is not reclaimed, leading to the observed discrepancy.

Finding the process that holds the deleted file

Linux exposes all open file descriptors under /proc/*/fd. Deleted files appear with the label (deleted) in the symlink target. The following command lists every such descriptor: sudo find /proc/*/fd -ls | grep '(deleted)' Sample output:

388609 0 lrwx------ 1 zerotier-one zerotier-one 64 Aug 21 00:19 /proc/29400/fd/4 -> /tmp/ibpX85Vd\ (deleted)
388610 0 lrwx------ 1 zerotier-one zerotier-one 64 Aug 21 00:19 /proc/29400/fd/5 -> /tmp/ibCwAgAj\ (deleted)
388611 0 lrwx------ 1 zerotier-one zerotier-one 64 Aug 21 00:19 /proc/29400/fd/6 -> /tmp/ibRZ5rep\ (deleted)
388612 0 lrwx------ 1 zerotier-one zerotier-one 64 Aug 21 00:19 /proc/29400/fd/7 -> /tmp/ibBuNEzA\ (deleted)
388616 0 lrwx------ 1 zerotier-one zerotier-one 64 Aug 21 00:19 /proc/29400/fd/11 -> /tmp/ibG68kpG\ (deleted)

Each line shows the PID (e.g., 29400) and the file descriptor that points to a deleted temporary file. Stopping or restarting the offending process will release the space.

Preventing the issue

Instead of deleting a large file outright, truncate it so the filesystem frees the blocks while the process keeps the file handle open. Two common truncation methods are: cat /dev/null > ${filename} or the more concise Bash syntax: : > ${filename} Both commands replace the file's contents with zero bytes, instantly freeing the occupied disk space without needing to terminate the process.

Reference

Find and remove large files that are open but have been deleted.