Identify Open Files #Linux

It was been very often asked by few of the system administrators as how to identify the open files in the Linux environment. 

Here we will identify the open files.

Environment : SuSE 11 

Given our intent, we use /var FS. Below, we see that /var has its own FS and we would see if any process are holding any files under "/var"

 linux:~ # df -h /var

Filesystem              Size  Used Avail Use% Mounted on

/dev/mapper/vg00-lvvar 1008M 1008M     0 100% /var

linux:~ # 

linux:~ # fuser -c /var 2>/dev/null

  1570  1585  1603  1691  1694  2626  2628  2663  3127  3142  3232  3257  3258  3299  3300  3301  3328  3349  3350  3351  3352  3353  3354  3486  3517  3518  3521  3525  3526  3528  3531  3540  3541  3549  3560  3563  3596  3599  5611  5614  6883linux:~ # 

Since we now know that there are opened files under "/var", let's see which particular files are opened.  We can do this by running a "for" loop on the output of 'fuser', using the resulting variable as part of our "/proc" path that we list out with 'ls'.

linux:~ # for i in `fuser -c /var 2>/dev/null` ; do echo "${i}:  `cat /proc/${i}/cmdline`" ; ls -ld /proc/${i}/fd/* | awk '/\/var/ {print "\t"$NF}' ; done

1570:  /sbin/acpid

1585:  /bin/dbus-daemon--system

1603:  /sbin/syslog-ng

/var/log/mail

/var/log/acpid

/var/log/warn

/var/log/mail.info

.

.

.

.

.

.

.

3560:  sshd: root@pts/0

3563:  -bash

3596:  sshd: root@pts/1

3599:  -bash

(deleted)

5611:  sshd: root@pts/2

5614:  -bash

6883:  /usr/lib/gdm/gdm-session-worker

/var/log/gdm/:0-slave.log

/var/log/gdm/:0-slave.log

cat: /proc/6928/cmdline: No such file or directory

6928:  

ls: cannot access /proc/6928/fd/*: No such file or directory

linux:~ # 

of intrest PID 3599 is holding an open file, that's because subsequent 'ls' on '/proc/3599/fd/*' shows that it is for writing STDOUT

linux:/var # ls -ld /proc/3599/fd/* | grep /var

l-wx------ 1 root root 64 Jul  5 10:47 /proc/3599/fd/1 -> /var/tmp/openfile.txt (deleted)

linux:/var # 

linux:/var # ls -l /var/tmp/openfile.txt 

ls: cannot access /var/tmp/openfile.txt: No such file or directory

linux:/var # 

by killing or restarting any application process, we could re-claim space in the disk.

You could also find an open files using 'lsof'

linux:/var # for u in `fuser -c /var 2>/dev/null`;do lsof -p $u | awk '{ if ( $7 > 100000000 ) print $0 }' ; done | grep del

bash    3599 root    1w   REG  253,7 924344320  49159 /var/tmp/openfile.txt (deleted)

linux:/var # 

linux:~ # kill -9 3599

linux:~ #

linux:~ # df -h /var

Filesystem              Size  Used Avail Use% Mounted on

/dev/mapper/vg00-lvvar 1008M  126M  832M  14% /var

linux:~ # 

Open file has been identified & deleted successfully.