9

I've a process which is using too much memory.

When I run lsof -p <pid> the output is :

ETL-GRIB 5981 root  DEL    REG    8,4          183633075 /tmp/icom/65516_GRIB/20150921220023_6796_YTXG23EGRR211800__ln_3857.shp
ETL-GRIB 5981 root  DEL    REG    8,4          183633059 /tmp/icom/65516_GRIB/20150921220023_6796_YTXG23EGRR211800__pl_3857.shp
...

What DEL mean? It could be that the process has the file in memory but It has been deleted by any other process?

alasarr
  • 1,565
  • 3
  • 16
  • 32
  • Did you read documentation of `lsof`? ` ''DEL'' for a Linux map file that has been deleted;` – Tsyvarev Sep 23 '15 at 15:21
  • Yes, I read, DEL abbreviation looks pretty obvious, but I'd like to confirm my question: It could be that the process has the file in memory but It has been deleted by any other process? I mean the process has a reference to the FD which has been removed – alasarr Sep 23 '15 at 15:28
  • 3
    `DEL` *in the FD column* is actually not documented for my version of `lsof`. It's documented for me when it appears in the `TYPE` column, and that appears to be what you've quoted. This question (and my question) is about when it appears in the `FD` column. This might be a bug in the documentation or `lsof`. – Thanatos Aug 16 '16 at 22:28

2 Answers2

13

lsof usually reports entries from the Linux /proc/<PID>/maps file with mem in the TYPE column. However, when lsof can't stat(2) a path in the process maps file and the mapsfile entry contains (deleted), indicating the file was deleted after it had been opened, lsof reports the file type as DEL.

Yes, Simply those files are deleted after they are read by the process. If you have updated/replaced those files then you probably want to restart the service/process.

terminal ninja
  • 396
  • 1
  • 11
Appu Sidhardh
  • 146
  • 1
  • 6
1

It could be that the process has the file in memory but It has been deleted by any other process?

Yes, or by the same process.

Armali
  • 18,255
  • 14
  • 57
  • 171