How to Recover Disk Space - Linux Disk Full Even After Deleting Files? Use lsof +L1 to Find and Fix Open Deleted Files

Have you ever deleted a huge file on your Linux server, expecting to finally free up some disk space… only to find that the disk is still full? Frustrating, right? You’re not imagining things. Sometimes, files don’t truly disappear because a process is still holding them open. It’s like they’re ghosts eating up your storage behind the scenes.

In this post, I’ll show you a simple trick using lsof +L1 to track down these sneaky deleted but still open files and reclaim your disk space — without guessing which process is causing the problem. By the end, you’ll have your Linux system breathing easy again

Step 1: Identify the Culprit Using lsof +L1

The first step is to find deleted but still open files. Use the following command:

sudo lsof +L1

What this does -> lsof lists all open files, +L1 filters files with fewer than 1 hard link, meaning the files are deleted but still in use by a process.

Example output:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME

rsyslogd 689 syslog 11w REG 259,1 10379912861 0 2110 /var/log/mail (deleted)

What this means:

The rsyslogd process (system logging service) is still writing to a deleted file.

That file is huge — over 10GB!

Disk space won’t be freed until the process releases the file.

Step 2: Free the Disk Space

Once you identify the process holding the deleted file, you have a few options:

Option A: Restart the Process (Safe and Easy)

sudo systemctl restart rsyslog

This closes the file handle.

Disk space is reclaimed automatically.

Option B: Truncate the File Without Stopping the Service

If OPTION A isn’t possible, then try safely empty the file:

sudo truncate -s 0 /proc/689/fd/11

Frees space immediately.

Keeps rsyslogd running without disruption.

Key Takeaways

1. Use sudo lsof +L1 to identify deleted but open files.

2. Restarting the process or truncating the file are safe ways to reclaim disk space.