Ki foglalja a mit foglal a hol foglalja? - Nem létező fájl létező ballaszt üzemmódban

Az lsof kilistázza a nyitott fájlokat. Tedd sorba méret szerint. Azt nem próbáltam, hogy a töröltek is benne vannak-e, valószínű igen.

Ez nem túl szép, de rendkívül hasznos.

Napi egyszer megméri a törölt-de-fogott fileokat, és szól ha túl sok, vagy túl nagy a mérete.

Összepárosítja a fileokat az őt tartó processz pidjével, hogy lehessen kinek küldeni a szignált, hogy ereszt el bélám, mert külünben megy a kill.

# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Check the deleted but existing files on the disk 
# Usage: Check_DeletedFiles severity <min-filesize-in-megabytes>
#
function Check_DeletedFiles() {

        if [ "x$2" == "x" ]; then
                threshold=100;
        else
                threshold=$2
        fi

	dateFile="/tmp/monitor_check-deleted.datefile"

	needCheck=1
	if [ -f "$dateFile" ]; then
		needTime=$(cat $dateFile)

			if [ ! -z $needTime ]; then
			currTime=$(date +"%s")

			if [ $currTime -lt $needTime ]; then
				needCheck=0
			fi
		fi
	fi

	if [ $needCheck -eq 1 ]; then

		# Pre-check the count of the deleted files, because the too many file will lead to extreme slow run (or OOM).
		# This behaviour was detected in the gui-test machines. With 5000+ files caused the OOM killer.
		maxDeletedFilesCount=200
		curDeletedFilesCount=$(/usr/sbin/lsof | grep -Ec "\(deleted\)$")

		if [ $curDeletedFilesCount -gt $maxDeletedFilesCount ]; then
			msg="Too many deleted file present: currently $curDeletedFilesCount file deleted but hold by process."
			SendMessage_Event "DELETEDFILES $msg"
		else
			# Collecting the open files and attributes from the /proc filesystem, then populate the procArray
			procLines="$( \
					ls -la --time-style="+%Y-%m-%d %H:%M:%S" /proc/*/fd/* 2> /dev/null | \
					grep -F " -> /" | grep -Fv " -> /dev/" | grep -E "\(deleted\)$" | \
					awk '{ match($0,/.*\/proc\/(.*)\/fd\/.*/, arr); printf "%s %s %s %s\n", arr[1], $10, $6, $7; }' \
				  )"
			# - Output: PID PATH DATE TIME

			declare -A procArray
				# 0 - PID
				# 1 - PATH
				# 2 - DATE
				# 3 - TIME

			procCounter=0
			oldIFS=$IFS
			IFS=$'\n'
			for line in $procLines; do
				IFS=$oldIFS
				read -r procPid procPath procDate procTime <<< "$line"
				IFS=$'\n'
				procArray[$procCounter,0]="$procPid"
				procArray[$procCounter,1]="$procPath"
				procArray[$procCounter,2]="$procDate"
				procArray[$procCounter,3]="$procTime"
				let procCounter++
			done
			IFS=$oldIFS

			# Collecting the open files and attributes from the lsof output, then populate the lsofArray
			lsofLines="$(/usr/sbin/lsof +c 15 | grep -E ".*REG.*\(deleted\)$" | awk '{ printf "%s %s %s %d\n", $2, $9, $1, $7/1048576; }')"
			# - Output: PID PATH SERVICE SIZE

			declare -A lsofArray
				# 0 - PID
				# 1 - PATH
				# 2 - SERVICE
				# 3 - SIZE

			lsofCounter=0
			oldIFS=$IFS
			IFS=$'\n'
			for line in $lsofLines; do
				IFS=$oldIFS
				read -r lsofPid lsofPath lsofService lsofSize <<< "$line"
				IFS=$'\n'
				lsofArray[$lsofCounter,0]="$lsofPid"
				lsofArray[$lsofCounter,1]="$lsofPath"
				lsofArray[$lsofCounter,2]="$lsofService"
				lsofArray[$lsofCounter,3]="$lsofSize"
				let lsofCounter++
			done
			IFS=$oldIFS

			foundKeys=()
			declare -A foundArray
				# PATH,0 - FLAG
				# PATH,1 - SIZE
				# PATH,2 - DATE
				# PATH,3 - TIME
				# PATH,4 - service1 (pid1), service2 (pid2), ...

			# Pairing the file and service (pid) entities, then raise event when the size is larger than the threshold
			for ((procIndex=0;procIndex<$procCounter;procIndex++)); do

				for ((lsofIndex=0;lsofIndex<$lsofCounter;lsofIndex++)); do
					procPid="${procArray[$procIndex,0]}"
					procPath="${procArray[$procIndex,1]}"
					procDate="${procArray[$procIndex,2]}"
					procTime="${procArray[$procIndex,3]}"
					lsofPid="${lsofArray[$lsofIndex,0]}"
					lsofPath="${lsofArray[$lsofIndex,1]}"
					lsofService="${lsofArray[$lsofIndex,2]}"
					lsofSize="${lsofArray[$lsofIndex,3]}"

					if [[ "$procPid" == "$lsofPid" ]] && [[ "$procPath" == "$lsofPath" ]]; then
						if [ $lsofSize -ge $threshold ]; then

							foundFlag="${foundArray[$procPath,0]}"
							if [[ "$foundFlag" == "1" ]]; then
								serviceList="${foundArray[$procPath,4]}"
								serviceList+=", $lsofService ($lsofPid)"
								foundArray[$procPath,4]="$serviceList"
							else
								foundArray[$procPath,0]="1"
								foundArray[$procPath,1]="$lsofSize"
								foundArray[$procPath,2]="$procDate"
								foundArray[$procPath,3]="$procTime"
								foundArray[$procPath,4]="$lsofService ($lsofPid)"
								foundKeys+=("$procPath")
							fi

						fi
					fi
				done
			done

			for key in ${foundKeys[@]}; do
				msg="$(printf "Found a deleted file: opened at %s %s by service %s. Actual size on disk: %d MB (threshold: %d MB). Path: %s" \
				"${foundArray[$key,2]}" "${foundArray[$key,3]}" "${foundArray[$key,4]}" "${foundArray[$key,1]}" "$threshold" "$(hostname -s):$key" )"

				SendMessage_Event "DELETEDFILES $msg"
			done
		fi

		nextTime=$(date --date="next day 07 AM" +"%s")
		echo "$nextTime" > "$dateFile"

	fi
}