A lot of the time a large log file will grow and need removed, most the time these files cannot actually be “deleted” or “cleared” until the service releases its file descriptor.
Identify the file:
List files recently deleted that have not been released.
root@osc-1015 #> lsof -a +L1COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAMEsystemd-j 1059 root txt REG 253,4 278808 0 11628 /usr/lib/systemd/systemd-journald;570ba957 (deleted)systemd-l 1451 root txt REG 253,4 584560 0 33117 /usr/lib/systemd/systemd-logind;570ba957 (deleted)monitor 1617 root 5w REG 253,4 500 0 261586 /var/log/openvswitch/ovsdb-server.log-20160404 (deleted)monitor 1617 root 7u REG 253,4 141 0 17 /tmp/tmpfsSX0WX (deleted)ovsdb-ser 1619 root 7u REG 253,4 141 0 17 /tmp/tmpfsSX0WX (deleted)monitor 1722 root 3w REG 253,4 474455 0 261589 /var/log/openvswitch/ovs-vswitchd.log-20160404 (deleted)ceph-osd 20462 root txt REG 253,4 11589728 0 33573 /usr/bin/ceph-osd;570b9a69 (deleted)ceph-osd 20686 root txt REG 253,4 11589728 0 33573 /usr/bin/ceph-osd;570b9a69 (deleted)qemu-kvm 107850 qemu 8w REG 253,4 2207794598 0 261623 /var/lib/nova/instances/8921a9ef-81c4-4a06-be00-7cad86bd6a1c/console.log (deleted) |
in this instance I need to clear the console.log file
Release the kernel lock:
Now we will release its lock in the kernel. The key parts here are the PID and FD, We remove the write flag from the FD and use its ID.
"/proc/107850/fd/8" |
Once ran the file is released and can be relocked by the process if it begins writing again.