Sponsored Content
Full Discussion: tcpdump - stealing storage
Top Forums UNIX for Dummies Questions & Answers tcpdump - stealing storage Post 302503998 by DoxieLvr on Sunday 13th of March 2011 12:57:39 AM
Old 03-13-2011
On Linux, if you delete ("unlink") a file while a process has it open, all that happens is that the directory entry is removed but the file itself remains until the process closes the file-descriptor. At this point, if there are no directory entries referencing the i-node of the file, the file itself is deleted.

Before the tcpdump processes were killed, you could have seen this using the lsof command.

I would guess that someone deleted the files but didn't kill the processes. The processes went on happy writing to the "deleted" files and filling up the filesystem until you came and killed them. Since killing the process implicitly closes all FDs, the files were finally deleted from the filesystem.

Does this help?
 

2 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Starting a program without it stealing focus

Hi all I have a java program I'm starting in Mac os from the terminal using the command java -Djava.library.path=/Users/me/Desktop/Cfiles/DynamicCTGLayout/build/Release -jar However, when I do this, my current program I'm using becomes "deselected" and the java program's GUI becomes... (2 Replies)
Discussion started by: WhiteTiger
2 Replies

2. UNIX for Dummies Questions & Answers

Display command stealing focus

Please Help a Newbie, I'm using the display command to post a picture of several configurations for a machine operator to choose from. The Issue I have is when I display the image the displayed image steals focus from my bash window. The operator then has to re-select the window to answer the... (1 Reply)
Discussion started by: BitBoy
1 Replies
REMOVE(3)						     Linux Programmer's Manual							 REMOVE(3)

NAME
remove - remove a file or directory SYNOPSIS
#include <stdio.h> int remove(const char *pathname); DESCRIPTION
remove() deletes a name from the filesystem. It calls unlink(2) for files, and rmdir(2) for directories. If the removed name was the last link to a file and no processes have the file open, the file is deleted and the space it was using is made available for reuse. If the name was the last link to a file, but any processes still have the file open, the file will remain in existence until the last file descriptor referring to it is closed. If the name referred to a symbolic link, the link is removed. If the name referred to a socket, FIFO, or device, the name is removed, but processes which have the object open may continue to use it. RETURN VALUE
On success, zero is returned. On error, -1 is returned, and errno is set appropriately. ERRORS
The errors that occur are those for unlink(2) and rmdir(2). ATTRIBUTES
For an explanation of the terms used in this section, see attributes(7). +----------+---------------+---------+ |Interface | Attribute | Value | +----------+---------------+---------+ |remove() | Thread safety | MT-Safe | +----------+---------------+---------+ CONFORMING TO
POSIX.1-2001, POSIX.1-2008, C89, C99, 4.3BSD. BUGS
Infelicities in the protocol underlying NFS can cause the unexpected disappearance of files which are still being used. SEE ALSO
rm(1), unlink(1), link(2), mknod(2), open(2), rename(2), rmdir(2), unlink(2), mkfifo(3), symlink(7) COLOPHON
This page is part of release 4.15 of the Linux man-pages project. A description of the project, information about reporting bugs, and the latest version of this page, can be found at https://www.kernel.org/doc/man-pages/. GNU
2017-09-15 REMOVE(3)
All times are GMT -4. The time now is 07:22 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy