Subj : Re: partition full - not really
To   : comp.os.linux.admin,comp.os.linux
From : Rich Gibbs
Date : Wed Jul 07 2004 12:37 pm

Pol said the following, on 07/07/04 08:36:
> Gerard Wassink wrote:
> 
>> e2fsck ?
>> reboot?
>>
> 
> Correct 'df' output is recovered after closing the xsession
> 
> Since the large deleted file was .xsession-errors,  my suspect is that 
> it had been actually removed, until the session was closed
> 

This is a consequence of how files "work" in Linux.  A file exists as a 
collection of disk blocks pointed to by a structure called an 'inode'. 
For every file/inode, the kernel maintains a reference count.  The count 
is incremented by 1 when a hard link (directory entry) is made to the 
file, or when the file is opened by a process.  The count is decremented 
when a link is removed, or when the file is closed by a process.

A file is only removed when the reference count goes to zero, which 
obviously will not happen as long as any process has the file open.

You will sometimes see Unix/Linux applications that create and open a 
temporary file, then immediately remove it (actually, remove its 
directory entry).  This works because the file will still be there as 
long as the process has it open; it will be deleted automagically if the 
process crashes or is killed.

-- 
Rich Gibbs
rgibbs@alumni.princeton.edu

.