On Sat, Feb 11, 2012 at 3:08 PM, Randy Kramer <rhkra...@gmail.com> wrote:
>>
>> Yes, lsof is helpful.
>
> lsof sounded like a good idea, but doesn't actually find the files. I guess
> it would find the files before the unlink occurred.
>From lsof(1):
+|-L [l] This option enables (`+') or disables (`-') the
listing of file link counts, where they are available - e.g.,
they aren't available for sockets, or most FIFOs and pipes.
When +L is specified without a following number, all
link counts will be listed. When -L is specified (the
default), no link counts will be listed.
When +L is followed by a number, only files having a
link count less than that number will be listed. (No num‐
ber may follow -L.) A specification of the form
``+L1'' will select open files that have been unlinked. A
specification of the form ``+aL1 <file_system>'' will
select unlinked open files on the specified file system.
I think you're looking for this:
$ lsof +aL1 /tmp
An example from my system:
cbell@circe:~$ lsof +aL1 | grep /var
chrome 32307 cbell 94u REG 253,0 512 0 61784919
/var/tmp/etilqs_S3SfsmS8MhVXOxc (deleted)
chrome 32307 cbell 95u REG 253,0 2056 0 61784953
/var/tmp/etilqs_3mghDvsIarM5CDM (deleted)
chrome 32307 cbell 96u REG 253,0 2048 0 61785079
/var/tmp/etilqs_B3yyRDGWM9OrqCt (deleted)
chrome 32307 cbell 98u REG 253,0 512 0 61785232
/var/tmp/etilqs_70rA3oEm7pTupPA (deleted)
chrome 32307 cbell 99u REG 253,0 2056 0 61785246
/var/tmp/etilqs_YCBsPHNcby6Xhrw (deleted)
chrome 32307 cbell 100u REG 253,0 2048 0 61785351
/var/tmp/etilqs_miiHl4skEWZ3NIZ (deleted)
chrome 32307 cbell 101u REG 253,0 16400 0 61785368
/var/tmp/etilqs_cWErUVIFFLoaNcb (deleted)
chrome 32307 cbell 109u REG 253,0 32800 0 61785419
/var/tmp/etilqs_3HTP6o7AXvsK61A (deleted)
chrome 32307 cbell 135u REG 253,0 4104 0 61785411
/var/tmp/etilqs_DRLNm3cGChRhGaN (deleted)
chrome 32307 cbell 138u REG 253,0 4104 0 61785573
/var/tmp/etilqs_TRcDQDpTNFe7QRn (deleted)
chrome 32307 cbell 197u REG 253,0 3084 0 61785424
/var/tmp/etilqs_DhJcahJFhw2BrgW (deleted)
chrome 32307 cbell 205u REG 253,0 4104 0 61785490
/var/tmp/etilqs_CBWOgcUjzQyQw7d (deleted)
cbell@circe:~$
I use grep to highlight /var as I don't use a separate /var partition.
--
Chris
--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive:
http://lists.debian.org/CAOEVnYsS-AE6Yt3cmbEzVbXNX1rm8b=p8k5z1dwtluzcpcu...@mail.gmail.com
