LPIC-1 Devices, Filesystems and FHS Practice Question
A server has a partition /dev/sda2 that is almost full. The admin suspects a large file has been deleted but is still held open by a process. Which command can identify such a file?
⚠ Common exam trap
Test-takers frequently choose `df -h` or `du` because they show disk usage, but they fail to realize that deleted-but-open files are invisible to those tools, while `lsof` directly reveals the hidden space consumption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
lsof | grep deleted
The `lsof` command lists open files and their associated processes. When a file is deleted but still held open by a process, `lsof` shows the filename with a '(deleted)' marker in its output. Piping through `grep deleted` filters for exactly those entries, allowing the admin to identify the file and the process keeping it alive, which is the precise scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
du -sh /
Why it's wrong here
du reports blocks used by files still linked in the directory tree, so a deleted-but-open file, which has no directory entry, is invisible to it. It is the right tool for finding which directories consume space, not for locating unlinked files held open by a process.
- ✗
find / -size +100M
Why it's wrong here
find matches directory entries by size, but a deleted file held open has no name or path, so find cannot return it. It is correct for locating large named files on disk, whereas the scenario needs the open file descriptors under /proc, which lsof or /proc/*/fd reveals.
- ✓
lsof | grep deleted
Why this is correct
lsof lists open file descriptors; filtering for deleted shows files unlinked from the directory but still held open, so the space is not reclaimed until the process closes or restarts. This identifies the culprit consuming the partition.
- ✗
df -h
Why it's wrong here
df reports filesystem-level block usage, showing that /dev/sda2 is full but not which process holds the space. It is the right command to confirm capacity and mount usage, yet identifying the deleted-but-open file requires inspecting open file descriptors, not filesystem totals.
Go deeper
Related to this question
About these practice questions
One of 402 original LPIC-1 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.