LFCS Essential Commands Practice Question
A system administrator notices that the disk space on the root filesystem is at 95% usage. After investigating, they find that a large log file named 'access.log' in /var/log is taking up significant space. The administrator deletes the file using 'rm /var/log/access.log' but the disk usage remains at 95%. Running 'df -h' still shows the same usage. What is the most likely cause and the correct next step?
⚠ Common exam trap
Watch out — candidates often assume 'rm' immediately frees disk space, but they overlook that open file descriptors by running processes (e.g., syslog, Apache) keep the data blocks allocated until the process is restarted or the descriptor is closed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.
When a file is deleted with 'rm' while it is still open by a running process, the file's directory entry is removed, but the inode and data blocks remain allocated until the process closes the file descriptor. This causes 'df' to still report the space as used. The correct next step is to use 'lsof' to find the process holding the file open and restart it, which releases the file descriptor and frees the disk space.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is compressed and needs to be decompressed. Use 'gzip -d access.log' first.
Why it's wrong here
Compression does not affect deletion behavior.
- ✗
The filesystem is marked as full in the superblock. Use 'fsck' to repair the filesystem.
Why it's wrong here
Filesystem corruption is unlikely and not the first step.
- ✓
The file is still open by a process. Use 'lsof | grep access.log' to identify the process and restart it.
Why this is correct
Deleted open files still consume space; finding and restarting the process releases the space.
- ✗
The file has multiple hard links. Use 'find / -links +1' to locate all hard links and delete them.
Why it's wrong here
Hard links would mean the file still exists under a different name; 'ls' would show it.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.