Re: [tlug] Permissions are like Rubik's cubes [SOLVED]

[Tod McQuillin <devin@example.com>]

On Tue, 2 Sep 2008, Stephen J. Turnbull wrote:

> Tod McQuillin writes:
>
> > For example, given the case above where a file has been unlinked, do 
> > you know how to find out with 100% certainty which process is holding 
> > a reference to the largest unlinked file?
>
> I would think lsof should give you that (modulo race conditions, of
> course).

lsof is only part of the puzzle.  lsof can tell you which files are 
referenced by processes but it won't tell you which of them are not linked 
from any directory.

For that you can use fsck -n on the filesystem in question.

Of course, from the point of view of fsck, these unreferenced files are a 
big problem, and if your system crashed right now without shutting down 
cleanly, it would be right.

But during normal system operation, this state of affairs (unreferenced 
files) is normal, and fsck can tell you about it.

You'll get a message like:

UNREF FILE I=70698  OWNER=root MODE=100644
SIZE=104857600 MTIME=Sep  2 15:10 2008
CLEAR? no

That I=70698 is your inode.  Then you can use lsof to find out which 
process is holding that inode and kill just that process to free up the 
space.
--
Tod