LPIC-1 Devices, Filesystems and FHS Practice Question
A system administrator is troubleshooting a server where the /var partition is full, causing services to fail. The administrator deletes old log files in /var/log, but the available space does not increase. Which step should be taken next?
⚠ Common exam trap
Test-takers frequently assume deleting files immediately frees space, but they overlook that processes can keep deleted files open, and they confuse memory caches (cleared by drop_caches) with disk space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.
When a file is deleted while a process still holds an open file descriptor to it, the file's data blocks are not freed until that process releases the handle. The `lsof /var/log` command identifies such processes, and restarting them forces the kernel to release the deleted inodes, thereby reclaiming the disk space. This is why option C is the correct next step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run 'sync; echo 3 > /proc/sys/vm/drop_caches' to clear cache.
Why it's wrong here
Clearing cache frees memory, not disk space.
- ✗
Remount the /var partition with the 'noatime' option.
Why it's wrong here
noatime reduces metadata updates but does not free space.
- ✓
Use 'lsof /var/log' to find processes holding deleted file handles, then restart those processes.
Why this is correct
Deleted files remain until all file handles are closed; lsof identifies the processes.
- ✗
Run 'df -i' to check inode usage.
Why it's wrong here
Inode exhaustion is a different issue; space is still consumed by open file handles.
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 527-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.