Centos文件已删除空间未释放

原创作者：运维工程师谢晋

Centos文件已删除空间未释放

释放已删除空间

释放已删除空间

很多时候，你会发现，明明已经删除了文件或日志，但是系统空间就是未缩减，很明显，有空间被已删除文件占用，文件删除了，但是资源没释放。
可以使用lsof命令去查看已删除却未释放资源的信息，lsof +L 1显示所有打开的链接数小于1的文件这通常（当不总是）表示某个攻击者正尝试通过删除文件入口来隐藏文件内容。

# lsof +L 1
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NLINK     NODE NAME
gnome-she  506 root   14u   REG  253,0    12288     0 34666607 /tmp/#34666607 (deleted)
gnome-she  506 root   39r   REG  253,0       64     0 34917133 /root/.local/share/gvfs-metadata/home.SYW5Y2 (deleted)
gnome-she  506 root   40r   REG  253,0    32768     0 34917157 /root/.local/share/gvfs-metadata/home-03b24dee.log (deleted)
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NLINK     NODE NAME
gnome-she  506 root   14u   REG  253,0    12288     0 34666607 /tmp/#34666607 (deleted)
gnome-she  506 root   39r   REG  253,0       64     0 34917133 /root/.local/share/gvfs-metadata/home.SYW5Y2 (deleted)
gnome-she  506 root   40r   REG  253,0    32768     0 34917157 /root/.local/share/gvfs-metadata/home-03b24dee.log (deleted)
gnome-she  506 root   44r   REG  253,0       64     0 34917280 /root/.local/share/gvfs-metadata/root.6JKUZ2 (deleted)
gnome-she  506 root   45r   REG  253,0    32768     0 34917281 /root/.local/share/gvfs-metadata/root-d9e7c251.log (deleted)
pulseaudi  696 root    6u   REG    0,4 67108864     0   256722 /memfd:pulseaudio (deleted)
nautilus-  780 root   15r   REG  253,0       64     0 34917159 /root/.local/share/gvfs-metadata/home.W3K1Y2 (deleted)
nautilus-  780 root   16r   REG  253,0    32768     0 34917172 /root/.local/share/gvfs-metadata/home-fe00ae10.log (deleted)