Determine processing holding open a 52+Gig file ...

[Philip Hallstrom]

> 'k, this is the second time its happened ... on a file system that is 
> currently 35% full (52G free), all the disk space disappeared ...
>
> Is there a way of finding out what process is holding open this "immense" 
> file?

I'm pretty sure lsof can tell you...

either just plain "lsof" or maybe with the directory name...

# lsof +D /tmp
COMMAND    PID     USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
postgres 66218 postgres    5u  unix 0xd9c93680      0t0      /tmp/.s.PGSQL.5432
sshd     66325     greg    7u  unix 0xd9d02800      0t0      /tmp/ssh-xIDIHoLn/agent.66325

+D D     This  option  causes  lsof to search for all open instances of
directory D and all the files and directories it  contains  to its
complete depth.

Processing  of  the  +D  option does not follow symbolic links within D
unless the -x or -x  l option is also specified.  Nor does  it  search
for open files on file system mount points on subdirectories of D unless
the -x or  -x   f  option  is  also specified.

Note:  the  authority  of the user of this option limits it to searching
for files that the user has  permission  to  examine with the system
stat(2) function.

Further  note: lsof may process this option slowly and require a large
amount of dynamic memory to do it.  This is because it must  descend
the entire directory tree, rooted at D, calling stat(2) for each file
and directory, building a  list  of  all the  files  it finds, and
searching that list for a match with every open file.  When directory D
is large, these  steps  can take a long time, so use this option
prudently.