Why a Deleted Linux File Can Still Consume Disk Space
Your root partition is at 100%, you ran rm on a 50GB log file, and df still reports zero free bytes. Here is how inodes, unlinked file descriptors, and kernel references keep ghost data alive, and how to recover disk space without restarting production. A critical disk alert fires on your phone. A busy database node or API host just crossed 99% disk capacity on /var . Applications begin failing.…
When a 50GB log file named debug.log was removed from the root partition, the partition still reported 100% capacity with no free space. This seemed perplexing. To understand what was happening, it's essential to know how Linux handles file deletion and inode management.
Linux does not delete files when you use the rm command. Instead, the rm command removes the directory entry that points to the file. It calls the unlink() system call, which decrements the inode's link count (i_nlink). When the i_nlink count reaches zero, indicating no directory entries are referencing the inode, the file is considered unlinked. However, the data blocks allocated for the file are not immediately reclaimed.
In Linux, files are composed of data blocks and inodes. The inode contains metadata like ownership, permissions, file size, and pointers to data blocks. The data blocks store the actual file contents. When a file is unlinked, the directory entry is removed, but the inode and its associated data blocks remain allocated until all processes referencing the file close their file descriptors.
If a process had opened the debug.log file, it would still hold an active file descriptor pointing to the inode. The i_nlink count would be zero, but the inode and data blocks would be marked as active in the kernel's open file table. This process could continue writing to those blocks, making them appear as if they are still in use.
The confusion arises from the two different ways Linux reports disk usage: df and du. df checks the superblock and reports the total number of blocks allocated to a filesystem, including those still allocated even if no files are pointing to them. On the other hand, du traverses directories and calculates the space used by files and directories based on their inode and block allocations.
So, in this case, the 52GB debug.log file had not been completely deleted from the filesystem. Its data blocks remained allocated, and its inode had an i_nlink count of zero but was still referenced by an active process. Until that process closed its file descriptor, the disk space would remain reserved, causing the partition to appear full.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
