🎯 Mission Briefing: Deleted, But Still Full

The disk is at 99%. Ana already deleted the giant debug log last night — 53 GB — but df still says the disk is full, and du can't find anything big. Is the disk lying?

Your objective

Find out where the space went, and free it.

Investigation toolkit

df -h                                    # How full is the disk?
sudo du -sh /var/log/*                   # Where are the big files…?
cat ~/note-from-ana.txt                  # What happened?
sudo lsof +L1                            # Open files that were deleted (link count 0)
sudo lsof | grep deleted                 # The same, the long way
ps aux | grep trace                      # The process behind it

Fix and verify

sudo kill 4711                           # The space is freed when the last process closes the file
df -h

💡 Deleting a file only removes its name. While a program still has it open, the data stays on disk — invisible to ls and du, but counted by df. Next time, empty a log in use with sudo truncate -s 0 FILE instead of deleting it.