Linux 文件删除原理_009

?

?

?

?

?

　　***了解Linux文件删除原理先了解一下文件inode索引节点，每个文件在Linux系统里都有唯一的索引节点（身份证号）

inode。如果文件存在硬链接，那这个文件和这个文件的硬链接的inode是相同的，并且可以创建许多硬链接。

　　参照了解inode索引节点?博客 ? ?https://www.cnblogs.com/zoulongbin/p/10456285.html

?

?

[[email?protected] test]# ls -li

total 0

140028 -rw-r--r-- 1 root root 0 Nov 16 17:25 file.txt

[[email?protected] test]# ln file.txt /tmp/file_hard_link1.txt

[[email?protected] test]# ln file.txt file_hare_link2.txt

[[email?protected] test]# ls -lih file.txt file_hare_link2.txt /tmp/file_hard_link1.txt

140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 file_hare_link2.txt

140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 file.txt

140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 /tmp/file_hard_link1.txt

?

?

一个文件被删除需要满足两个条件：

　　i_link 硬链接数为0 并且 i_count 进程引用计数也为0，文件才算被删除，否则文件不能说被删除。

文件没被删除，文件的inode索引结点号系统是没有回收的，文件只有完全被删除了后，系统才

会回收文件inode索引节点，而后被创建的新文件使用。

?

?

?

?

实验

?

1、创建两文件之前先df –i查看分区inode，创建两个文件，一个file.txt，

内容testfile，另一个文件text.txt，内容abcdef，再查看分区inode变化

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55834 537510?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

[[email?protected] test]# echo "testfile" > file.txt

[[email?protected] test]# echo "abcdef" > text.txt

[[email?protected] test]# ls -l

total 8

-rw-r--r-- 1 root root 9 Nov 16 18:22 file.txt

-rw-r--r-- 1 root root 7 Nov 16 18:23 text.txt

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55836 537508?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

?

?

2、创建硬链接对inode大小没有影响

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55836 537508?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1? ?????51200??? 38? 51162??? 1% /boot

[[email?protected] test]# ln file.txt file_hard_link.txt

[[email?protected] test]# ln text.txt text_hard_link.txt

[[email?protected] test]# ls -lih

total 16K

140028 -rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt

140028 -rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt

140787 -rw-r--r-- 2 root root 7 Nov 16 18:23 text_hard_link.txt

140787 -rw-r--r-- 2 root root 7 Nov 16 18:23 text.txt

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55836 537508?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

?

?

3、删除text.txt文件本身外还要删除硬链接文件，这样才text.txt文件才算被删除

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3? ????593344 55836 537508?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

[[email?protected] test]# find /test/ -type f -name "text.txt" -delete

[[email?protected] test]# ls -l

total 12

-rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt

-rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt

-rw-r--r-- 1 root root 7 Nov 16 18:23 text_hard_link.txt

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55836 537508?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

[[email?protected] test]# find /test/ -type f -name "text_hard_link.txt" -delete

[[email?protected] test]# ls -l

total 8

-rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt

-rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55835 537509?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

?

?

4、使用vim file.txt打开文件，然后打开另一个SSH删除file.txt和file_hard_link.txt后观察分区inode

[[email?protected] test]# vim file.txt

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55835 537509?? 10% /

tmpfs????? ????125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

[[email?protected] test]# ls

file_hard_link.txt? file.txt

[[email?protected] test]# find /test/ -type f -delete

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55835 537509?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162??? 1% /boot

[[email?protected] test]#???? ?????????????????????##退出file.txt编辑模式

[[email?protected] test]# ls

file.txt

[[email?protected] test]# find /test/ -type f -delete

[[email?protected] test]# df -i

Filesystem???? Inodes IUsed? IFree IUse% Mounted on

/dev/sda3????? 593344 55834 537510?? 10% /

tmpfs????????? 125596???? 1 125595??? 1% /dev/shm

/dev/sda1?????? 51200??? 38? 51162?? ?1% /boot

?

?

?

?

?

企业案例1：Web服务器磁盘分区爆满故障深入解析

?

原因：

　　tomcat记录日志access_log过大导致分区爆满，直接删除了tomcatl日志文件access_log，删除access_log记录日志文件后使用df –h查看磁盘分区还是爆满。

?

?

?

创建模拟场景：

?

##yum安装httpd(tomcat)

[[email?protected] ~]# yum -y install httpd

[[email?protected] ~]# rpm -qa httpd

httpd-2.2.15-69.el6.centos.x86_64

?

##启动httpd服务

[[email?protected] ~]# /etc/init.d/httpd start

Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy

httpd: Could not reliably determine the server‘s fully qualified domain name,using 127.0.0.1 for ServerName

?????????????????????????????????????????????????????????? [? OK? ]

?

##查看htttpd是否运行

[[email?protected] ~]# lsof -i :80

COMMAND? PID?? USER?? FD?? TYPE DEVICE SIZE/OFF NODE NAME

httpd?? 2812?? root??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2814 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2815 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2816 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2817 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2818 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2819 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2820 apache??? 4u? IPv6? 15539????? 0t0? TCP *:http (LISTEN)

httpd?? 2821 apache??? 4u? IPv6? 15539?? ???0t0? TCP *:http (LISTEN)

?

##关闭防火墙

[[email?protected] ~]# /etc/init.d/iptables stop

?

##修改httpd服务配置文件httpd.conf日志存放路径

[[email?protected] ~]# grep "#CustomLog logs/access_log" /etc/httpd/conf/httpd.conf

#CustomLog logs/access_log common

[[email?protected] logs]#sed -i ‘[email?protected]#CustomLog logs/access_log [email?protected] /app/logs/access_log [email?protected]‘ /etc/httpd/conf/httpd.conf

[[email?protected] logs]# grep "CustomLog /app/logs/access_log" /etc/httpd/conf/httpd.conf

CustomLog /app/logs/access_log common

?

##创建一个模拟的分区/dev/sdb，block大小8K

[[email?protected] ~]# dd if=/dev/zero of=/dev/sdb bs=8k count=10

10+0 records in

10+0 records out

81920 bytes (82 kB) copied,0.000203364 s,403 MB/s

?

##格式化/dev/sdb为ext3系统文件格式

[[email?protected] ~]# mkfs -t ext3 /dev/sdb

?

##创建一个/dev/sdb挂载点/app/logs

[[email?protected] ~]# mkdir -p /app/logs

?

#把/dev/sdb挂载到/app/logs

[[email?protected] ~]# mount -o loop /dev/sdb /app/logs/

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 14K?? 55K? 21% /app/logs

[[email?protected] ~]# ls -l /app/logs/

total 12

drwx------ 2 root root 12288 Nov 16 19:27 lost+found

?

##重启httpd服务使配置文件生效

[[email?protected] ~]# /etc/init.d/httpd restart

Stopping httpd:??????????????????????????????????????????? [? OK? ]

Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy

httpd: Could not reliably determine the server‘s fully qualified domain name,using 127.0.0.1 for ServerName

????????????? ?????????????????????????????????????????????[? OK? ]

[[email?protected] ~]# cat /app/logs/access_log

?

##把httpd服务首页内容修改成oldboy

[[email?protected] ~]# echo oldboy > /var/www/html/index.html

?

##访问httpd服务，使其产生日志记录

[[email?protected] ~]# curl 127.0.0.1

oldboy

[[email?protected] ~]# cat /app/logs/access_log

127.0.0.1 - - [16/Nov/2018:19:33:26 +0800] "GET / HTTP/1.1" 200 7

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 15K?? 54K? 22% /app/logs

?

##打开一个新SSH窗口，使用这条命令自动刷访问，把tomcat的记录日志access_log增大，撑满/dev/sdb分区容量

[[email?protected] ~]# for n in `seq 1000`;do curl 127.0.0.1;done

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 71K???? 0 100% /app/logs

?

##删除/app/logs记录日志文件

[[email?protected] ~]# find /app/logs/ -type f -name "access_log" -delete

[email?protected] ~]# ls -lh /app/logs/

total 12K

drwx------ 2 root root 12K Nov 16 19:27 lost+found

?

##查看/dev/sdb分区容量依然爆满

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G ?1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 73K???? 0 100% /app/logs

?

?

解决办法1：重启httpd服务

标注：使用这种办法是因为进程正在调用access_log记录日志文件，直接删除并不能直接删除这个文件，只能重启httpd服务释放，建议使用下面的解决办法2

?

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 73K???? 0 100% /app/logs

[[email?protected] ~]# /etc/init.d/httpd restart

Stopping httpd:??????????????????????????????????????????? [? OK? ]

Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy

httpd: Could not reliably determine the server‘s fully qualified domain name,using 127.0.0.1 for ServerName

?????????????????????????????????????????????????????????? [? OK? ]

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 14K?? 55K? 21% /app/logs

?

?

?

解决办法2：不删除access_log文件，直接清空access_log文件内容

?

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs??????? ???491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 73K???? 0 100% /app/logs

[[email?protected] ~]# > /app/logs/access_log

[[email?protected] ~]# df -h

Filesystem????? Size? Used Avail Use% Mounted on

/dev/sda3?????? 8.8G? 1.5G? 7.0G? 17% /

tmpfs?????????? 491M???? 0? 491M?? 0% /dev/shm

/dev/sda1?????? 190M?? 36M? 145M? 20% /boot

/dev/sdb???????? 73K?? 14K?? 55K? 21% /app/logs

?

?

?

?

?

?

?

?

?

感谢老男孩博客提供参考? https://blog.51cto.com/oldboy