Why Does Disk Space Appear Full Even After Deleting Files? Understanding Linux VFS and Inode Mechanics

When a Linux system reports that the disk is full but tools like du show plenty of free space, the discrepancy is caused by files that have been deleted while still being held open by running processes. The space occupied by these files is not released until the processes close them.

Reproducing the Issue

1. Running df -Th shows the filesystem is 100% used.

-bash-4.2$ df -Th
Filesystem      Type   Size  Used Avail Use% Mounted on
/dev/vda1       ext4    30G   30G   0   100% /
...

2. Using du -h --max-depth=1 /home reveals only about 22 GB used, leaving over 10 GB seemingly missing.

-bash-4.2$ du -h --max-depth=1 /home
16M /home/logs
11G /home/serverdog
11G /home

3. The hidden usage is due to deleted files still opened by processes. The lsof command lists such files.

-bash-4.2# lsof | grep delete
mysqld 2470 mysql 4u REG 253,1 0 523577 /var/tmp/ibfTeQFn (deleted)
mysqld 2470 mysql 5u REG 253,1 0 523579 /var/tmp/ibaHcIdW (deleted)
...

Restarting or terminating the offending processes releases the space.

Linux Virtual File System (VFS)

The VFS is the abstraction layer that all Linux file systems (ext3, NFS, etc.) implement. It provides a common file model consisting of:

Superblock object – metadata about the file system, stored in memory and on disk.

Inode object – represents a file's metadata; each inode has a unique number.

File object – created when a process opens a file, linking the process to an inode.

Dentry object – directory entry that maps a name to an inode.

These objects exist both in memory (when accessed) and on disk (persistent structures). The kernel uses open() and close() to manage reference counts ( i_count) on inodes, and i_nlink to track hard link counts.

File and Process Interaction

When a file is deleted, its directory entry is removed, decreasing i_nlink. However, if a process still holds an open file object, the inode remains in memory, preventing the space from being reclaimed. The write‑back cache policy means data is only written back to disk when the inode is flushed, and the space is freed only after the inode’s reference count drops to zero.

Deletion Workflow

The rm command opens the parent directory.

It uses iget to increase the directory’s inode reference count.

The directory data is read and converted into dentry objects.

Each dentry’s inode count is increased via iget.

The directory entry is removed, decreasing i_nlink of the target file. iput decrements i_count; if it reaches zero, the inode is released from memory.

If i_nlink is also zero, the disk blocks are freed.

Key Takeaways

The core of Linux file management is the separation of file data and its indexing structures (inodes). Understanding VFS, inode reference counting, and the role of lsof helps diagnose why disk space may appear occupied even after files are deleted.

Summary

Disk space can remain occupied after file deletion because open processes keep the inode alive. The VFS abstracts file operations through superblocks, inodes, dentries, and file objects. Commands like lsof reveal these hidden usages, and restarting the processes frees the space.