iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Running rm removes a filename, not always the data behind it. If a process still has the file open, Linux keeps its blocks allocated, so df continues to report the space as used even though the file no longer appears in any directory listing. The space returns only when the last open reference to the file closes. The fix is to find the process holding the file, have it release the file through its own supported method, and then confirm the result with df.
Why deleting a file doesn’t always free space
A file on a Linux filesystem has two parts: the data blocks that hold its contents, and an inode that records metadata and the number of directory entries (hard links) pointing to it. A directory entry is just a name attached to an inode. The GNU rm manual describes removing a file as unlinking that name. Unlinking one name does not by itself release the data.
The kernel releases a file’s blocks only when two conditions are both false: no directory entry points to the inode, and no process holds an open file descriptor for it. A running program that opened a log or data file before it was deleted still holds that descriptor, and it can keep reading and writing through it. From the filesystem’s point of view, the file is deleted but still in use. Its space stays allocated until the program closes the descriptor or exits.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The same logic explains a related case: if a file has a second hard link in another directory, removing one name leaves the data in place.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
For example, suppose a 20 GB application log is deleted while the application keeps writing to it. df -h /var shows the filesystem at 95% used. du run on /var adds up to far less, because the log’s name no longer exists to be walked. The gap between those two numbers is the symptom of a deleted file that is still open.
Know what df and du actually measure
Most troubleshooting in this area depends on not confusing these two commands. They measure different things, so a difference between them is a clue to investigate, not proof of a single cause.
| Question | df | du |
|---|---|---|
| What it reports | Free and used capacity of the filesystem that contains the path you give it (df(1)) |
Storage attributed to files and directories it can traverse by pathname (GNU du(1)) |
| Scope | Whole filesystem | Only what can be reached by walking named paths |
| Counts a deleted file that is still open? | Yes, because the blocks remain allocated | No, because the old pathname can no longer be walked |
| Typical use | Confirm that a filesystem is full | Find which directories hold the space |
| Cautions | Reserved blocks and inode exhaustion can make a filesystem look full for different reasons | GNU du --apparent-size reports file length rather than allocated blocks, so compare like with like; BSD and macOS du options differ |
Diagnose the problem step by step
-
Confirm which filesystem is full. Run
df -h /path/to/affected/location. Use the path that is actually failing, such as/varor/home, becausedfreports the filesystem that contains that path.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
-
Compare with visible directory usage on the same filesystem. Run
sudo du -xhd1 /mountpoint. On GNU systems,-xkeeps the walk on one filesystem,-hprints human-readable sizes, and-d1limits output to one directory level. Ifdfreports the disk nearly full whileduaccounts for much less, go to the next step. If both agree, the space is in visible files, and you can work through those directories instead. -
Look for deleted files that are still open. Run
sudo lsof +L1. This lists open files whose link count is below one, meaning they have no directory entry left. To limit the output to one filesystem, pass its mount point:sudo lsof +L1 /var. In the output, read the COMMAND, PID, FD, SIZE/OFF, and NLINK columns, and check the NAME column for the old path followed by(deleted). The large SIZE/OFF value on a deleted entry usually matches the space you cannot account for. -
Identify the owning process before acting. Confirm what it is and whether it matters:
Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
ps -p PID -o pid,user,lstart,cmdshows the command, owner, and start time.sudo ls -l /proc/PID/fd | grep deletedlists that process’s descriptors that point to deleted files.
-
Release the file through the application’s supported procedure. Use the application’s documented way to reopen log files, or a planned restart of its service during an appropriate window, for example
sudo systemctl restart SERVICE_NAMEafter checking the unit name withsystemctl list-units --type=service. Consider whether the workload can tolerate the restart and whether any unflushed data needs attention first.Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Recheck the filesystem. Run
df -hagain. The freed space should appear once the last descriptor closes. Iflsof +L1no longer lists the file, the reference is gone.
If no deleted open file explains the gap
Some full-disk reports have other causes. Work through these branches in order:
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Inode exhaustion. A filesystem can run out of inodes while still having free blocks. Run
df -i. If the IUse% column is at or near 100%, the problem is a large number of small files, not large files. - Reserved blocks on ext2, ext3, and ext4. These filesystems reserve a share of blocks for privileged use. Non-root users can see the disk as full while root still has room. Read the reserved count with
sudo tune2fs -l /dev/DEVICE | grep -i 'reserved block count', replacing DEVICE with the block device for that mount. - Snapshots and container storage. Btrfs, ZFS, and LVM snapshots, and container runtimes, can hold space that ordinary directory walks do not show. Use each tool’s own accounting, such as
docker system dffor Docker, or the snapshot listing for your filesystem or volume manager. - Mount confusion. A directory may sit on a different filesystem than you expect. Check with
findmnt -T /pathto see which mount actually contains it.
These branches are common explanations, not guaranteed findings on every system. Confirm each one against the output on your own machine.
What not to do
- Do not run
rmon the deleted path again. The name is already gone, and the space is held by the descriptor, not the name. - Do not truncate
/proc/PID/fd/Nto clear space. The process may still be writing active data, and truncating its descriptor can corrupt output or break the application. Use this only for a specific, understood case. - Do not use
kill -9as a default fix. A forced kill skips the application’s shutdown and can leave data in an inconsistent state. A normal, planned stop or restart is safer. - Do not reboot as a first step. A reboot releases every descriptor, but it affects every service on the machine. Identify the owning process first.
Journal logs: a separate, safer branch
If the process holding space is systemd-journald, the fix is retention management rather than process release. Start by checking how much the journal uses:
Recommended Free Tools
- Run
journalctl --disk-usageto see the current journal size. - To reduce it, use
sudo journalctl --vacuum-size=500Mto keep the archived files under a size limit, orsudo journalctl --vacuum-time=2weeksto remove archived files older than a given age. - Check the result with
journalctl --disk-usageagain.
Vacuuming removes only archived journal files. Active journal files are not removed, so the space recovered can be smaller than the total that --disk-usage reported. The systemd 255 manual for journalctl documents this behavior. Confirm the option syntax for your installed version with journalctl --version before you apply it.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Prevent the problem next time
Most of these cases start with a log or temporary file that grows while a process holds it open. Set rotation for logs so that files are reopened on a schedule, monitor both block and inode usage so that you see growth before the disk fills, and give long-running services a documented way to reopen their log files. When you delete large files on a busy system, check lsof +L1 afterward so that a lingering descriptor does not hide the space you expected to recover.
Reference sources for the behavior described here: the GNU rm manual, the lsof(8) manual page, the df(1) and GNU du(1) manual pages, Red Hat’s support article on deleted files still consuming disk space, and the systemd 255 journalctl manual.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
