Interesting facts about the Linux file system

written by Georg, on Tuesday, March 25, 2008 20:20.

Sometimes you get lucky. (Warning: dramatic events ahead.)

I was playing a large video file with mplayer when I made the mistake to delete it because of a command line accident (note to self: relying on the shell history to do what you mean is evil). First I thought "nice, now I can download the whole 500 MB again", but I realized that the file must still be available somewhere on disk because mplayer still needs to access it.

Helpful people from IRC pointed me to /proc/pid/fd/ which is a directory with symlinks to open files, but didn't believe it would do any good because the symlink's target is already gone.

Not one to give up easily, I looked into there, and the listing looked like that:

$ ls -l /proc/pid/fd
total 0
dr-x------ 2 gbr users  0 Mar 25 21:28 .
dr-xr-xr-x 5 gbr users  0 Mar 25 21:27 ..
lrwx------ 1 gbr users 64 Mar 25 21:28 0 -> /dev/pts/7
lrwx------ 1 gbr users 64 Mar 25 21:28 1 -> /dev/pts/7
lrwx------ 1 gbr users 64 Mar 25 21:28 2 -> /dev/pts/7
lr-x------ 1 gbr users 64 Mar 25 21:28 3 -> /home/gbr/video.mov (deleted)
...

Curious. Not the usual "broken symlink" view. And indeed, I could open the file and copy its contents somewhere safe. Isn't that nice?

Comments

yeah, it's kind of cool.

Linux uses references to files. So if processes hold a reference to a file it won't be deleted until all the processes drop their references.

Another common time you might notice this is with servers and their log files. There might be a 4 gig file, which you decide to delete - but because the server still has the file open you do not recover the space on the file system. Which is why you need to send signals to the servers to reopen their log files.

— illume on Tuesday, March 25, 2008 21:15 #
I knew that files stay there until they're closed by all processes -- but I was surprised that you can access them via the /proc/.../fd symlinks.

— Georg on Tuesday, March 25, 2008 21:18 #
ah :)

yeah, /proc is super cool.

— illume on Tuesday, March 25, 2008 23:07 #
strange , I don't have /proc/pid folder :(

— Kushal Das on Thursday, March 27, 2008 8:32 #
You'll have to replace "pid" by the pid of your process.

— Georg on Thursday, March 27, 2008 8:39 #
illume: Another trick for large log files is to do an "echo > logfile": this clobbers the contents of the file without requiring most services to be restarted.

— cwillu on Sunday, March 30, 2008 4:29 #
Could you just not create a hard link to the file inode pointed to by the symlink of /proc/<pid>/fd/3, instead of having to copy it and temporarily waste disk space?

$ ln `readlink /proc/<pid>/fd/3` ~/saved.move # will not work

$ ln -<some switch> /proc/<pid>/fd/3 ~/saved.mov # perhaps?

— Alok on Sunday, March 30, 2008 22:38 #

Commenting is no longer possible.