我对输出文件执行“ rm”操作后，C程序在哪里写输出？

Question

I ran a rather nasty C program on a computing cluster running Redhat that got into an infinite loop, within each of which it printed a line of output. When I realized it was quickly creating a file that would eventually use up all the disk space, I ran "rm" on that output file before I killed the program. Unfortunately, per "df -h" space continued to get used up on the drive before I finally killed the program.

I now can't find the file that was written, so I'm unable to delete it. Where would such a file be written to?

Answer 1

Killing the program should release the disk space. Until then, the file is unlinked from its folder, but will not cease to exist (as an inode) as long as it is actively open.

Check ls -l /proc/<pid>/fd to see what the files are; essentially, everything the kernel knows about that process is somewhere in /proc/<pid> .

Read a lot more on how to deal with these problems here: https://unix.stackexchange.com/questions/68523/find-and-remove-large-files-that-are-open-but-have-been-deleted

Answer 2

It was writing to the file you deleted.

Per the man page for unlink(3) :

The unlink() function shall remove a link to a file. If path names a symbolic link, unlink() shall remove the symbolic link named by path and shall not affect any file or directory named by the contents of the symbolic link. Otherwise, unlink() shall remove the link named by the pathname pointed to by path and shall decrement the link count of the file referenced by the link.

When the file's link count becomes 0 and no process has the file open, the space occupied by the file shall be freed and the file shall no longer be accessible. If one or more processes have the file open when the last link is removed, the link shall be removed before unlink() returns, but the removal of the file contents shall be postponed until all references to the file are closed .

Answer 3

In Unix/Linux a file is a datastructure (on disc). As long as a pointer (or reference, see below) to this exists in the system, the data is not deleted. Once there is no pointer anymore, it is, however.

A pointer can be basically having the file opened by a program. Once the program (or these programs) terminates, this pointer becomes invalid.

A pointer can also be an entry in a directoy of the filesystem. This would be the entry you see with ls or in a graphical filemanager. So, once you remove this entry, that pointer is also deleted, but no other! Note that there can be multiple such entries all over the (same) file system. These are called hardlinks (many (pointers) to one (file) relation).

Actually, the file counts all these references (permanent on disc for directory entries/hardlinks or in system memory for open files ("file handles)). The latter costs precious system memory for each open file and is one reason why a file most always be closed and should be asap.

So, once all pointers are deleted, the file cannot be accessed anymore and so it will be deleted. This is called garbage collection (if that was invented nowadays, it might have been called "memory recycling" perhaps) btw. and is similar to what languages like Java and Python do for unused objects.

Reason why I called it "pointer" is the similarity: It is actually a specific index (address) of a data structure called "inode" where it points to, not the directory entry.