Re: Resolved as far as possible, I think: was: Re: "Invisible" files on /tmp from Flash or Iceweasel?

["Christofer C. Bell" <christofer.c.bell@gmail.com>]

On Sat, Feb 11, 2012 at 3:08 PM, Randy Kramer <rhkramer@gmail.com> wrote:
>>
>> Yes, lsof is helpful.
>
> lsof sounded like a good idea, but doesn't actually find the files.  I guess
> it would find the files before the unlink occurred.

>From lsof(1):

       +|-L [l] This  option  enables  (`+') or disables (`-') the
listing of file link counts, where they are available - e.g.,
                they aren't available for sockets, or most FIFOs and pipes.

                When +L is specified without a following number, all
link counts will be listed.   When  -L  is  specified  (the
                default), no link counts will be listed.

                When  +L is followed by a number, only files having a
link count less than that number will be listed.  (No num‐
                ber may follow -L.)  A specification of the form
``+L1'' will select open files  that  have  been  unlinked.   A
                specification of the form ``+aL1 <file_system>'' will
select unlinked open files on the specified file system.


I think you're looking for this:

$ lsof +aL1 /tmp

An example from my system:

cbell@circe:~$ lsof +aL1  | grep /var
chrome    32307 cbell   94u   REG   253,0      512     0 61784919
/var/tmp/etilqs_S3SfsmS8MhVXOxc (deleted)
chrome    32307 cbell   95u   REG   253,0     2056     0 61784953
/var/tmp/etilqs_3mghDvsIarM5CDM (deleted)
chrome    32307 cbell   96u   REG   253,0     2048     0 61785079
/var/tmp/etilqs_B3yyRDGWM9OrqCt (deleted)
chrome    32307 cbell   98u   REG   253,0      512     0 61785232
/var/tmp/etilqs_70rA3oEm7pTupPA (deleted)
chrome    32307 cbell   99u   REG   253,0     2056     0 61785246
/var/tmp/etilqs_YCBsPHNcby6Xhrw (deleted)
chrome    32307 cbell  100u   REG   253,0     2048     0 61785351
/var/tmp/etilqs_miiHl4skEWZ3NIZ (deleted)
chrome    32307 cbell  101u   REG   253,0    16400     0 61785368
/var/tmp/etilqs_cWErUVIFFLoaNcb (deleted)
chrome    32307 cbell  109u   REG   253,0    32800     0 61785419
/var/tmp/etilqs_3HTP6o7AXvsK61A (deleted)
chrome    32307 cbell  135u   REG   253,0     4104     0 61785411
/var/tmp/etilqs_DRLNm3cGChRhGaN (deleted)
chrome    32307 cbell  138u   REG   253,0     4104     0 61785573
/var/tmp/etilqs_TRcDQDpTNFe7QRn (deleted)
chrome    32307 cbell  197u   REG   253,0     3084     0 61785424
/var/tmp/etilqs_DhJcahJFhw2BrgW (deleted)
chrome    32307 cbell  205u   REG   253,0     4104     0 61785490
/var/tmp/etilqs_CBWOgcUjzQyQw7d (deleted)
cbell@circe:~$

I use grep to highlight /var as I don't use a separate /var partition.

-- 
Chris