Linux 文件删除原理
了解Linux文件删除原理先了解一下文件inode索引节点，每个文件在Linux系统里都有唯一的索引节点（身份证号）inode。如果文件存在硬链接，那这个文件和这个文件的硬链接的inode是相同的，并且可以创建许多硬链接。
[root@oldboy test]# ls -li
total 0
140028-rw-r--r-- 1 root root 0 Nov 16 17:25 file.txt
[root@oldboy test]# ln file.txt /tmp/file_hard_link1.txt
[root@oldboy test]# ln file.txt file_hare_link2.txt
[root@oldboy test]# ls -lih file.txt file_hare_link2.txt
/tmp/file_hard_link1.txt
140028-rw-r--r-- 3 root root 0 Nov 16 17:25 file_hare_link2.txt
140028-rw-r--r-- 3 root root 0 Nov 16 17:25 file.txt
140028-rw-r--r-- 3 root root 0 Nov 16 17:25 /tmp/file_hard_link1.txt
一个文件被删除需要满足两个条件：
i_link 硬链接数为0 并且 i_count 进程引用计数也为0，文件才算被删除，否则文件不能说被删除。文件没被删除，文件的inode索引结点号系统是没有回收的，文件只有完全被删除了后，系统才会回收文件inode索引节点，而后被创建的新文件使用。
实验
1、创建两文件之前先df –i查看分区inode，创建两个文件，一个file.txt，内容testfile，另一个文件text.txt，内容abcdef，再查看分区inode变化
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55834 537510 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# echo "testfile" > file.txt
[root@oldboy test]# echo "abcdef" > text.txt
[root@oldboy test]# ls -l
total 8
-rw-r--r-- 1 root root 9 Nov 16 18:22file.txt
-rw-r--r-- 1 root root 7 Nov 16 18:23text.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
2、创建硬链接对inode大小没有影响
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ln file.txtfile_hard_link.txt
[root@oldboy test]# ln text.txttext_hard_link.txt
[root@oldboy test]# ls -lih
total 16K
140028 -rw-r--r-- 2 root root 9 Nov 1618:22 file_hard_link.txt
140028-rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt
140787 -rw-r--r-- 2 root root 7 Nov 1618:23 text_hard_link.txt
140787 -rw-r--r-- 2 root root 7 Nov 1618:23 text.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
3、删除text.txt文件本身外还要删除硬链接文件，这样才text.txt文件才算被删除
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# find /test/ -type f -name "text.txt"-delete
[root@oldboy test]# ls -l
total 12
-rw-r--r-- 2 root root 9 Nov 16 18:22file_hard_link.txt
-rw-r--r-- 2 root root 9 Nov 16 18:22file.txt
-rw-r--r-- 1 root root 7 Nov 16 18:23text_hard_link.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# find /test/ -type f -name"text_hard_link.txt" -delete
[root@oldboy test]# ls -l
total 8
-rw-r--r-- 2 root root 9 Nov 16 18:22file_hard_link.txt
-rw-r--r-- 2 root root 9 Nov 16 18:22file.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
4、使用vim file.txt打开文件，然后打开另一个SSH删除file.txt和file_hard_link.txt后观察分区inode
[root@oldboy test]# vim file.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ls
file_hard_link.txt file.txt
[root@oldboy test]# find /test/ -type f -delete
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ls
file.txt
[root@oldboy test]# find /test/ -type f -delete
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55834 537510 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
企业案例1：Web服务器磁盘分区爆满故障深入解析
原因：
tomcat记录日志access_log过大导致分区爆满，直接删除了tomcatl日志文件access_log，删除access_log记录日志文件后使用df –h查看磁盘分区还是爆满。
创建模拟场景：
#==》yum安装httpd(tomcat)
[root@oldboy ~]# yum -y install httpd
[root@oldboy ~]# rpm -qa httpd
httpd-2.2.15-69.el6.centos.x86_64
#==》 启动httpd服务
[root@oldboy ~]# /etc/init.d/httpd start
Starting httpd: httpd:apr_sockaddr_info_get() failed for oldboy
httpd: Could not reliably determine theserver's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
#==》 查看htttpd是否运行
[root@oldboy ~]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 2812 root 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2814 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2815 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2816 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2817 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2818 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2819 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2820 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2821 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
#==》 关闭防火墙
[root@oldboy ~]# /etc/init.d/iptables stop
#==》 修改httpd服务配置文件httpd.conf日志存放路径
[root@oldboy ~]# grep "#CustomLog logs/access_log"
/etc/httpd/conf/httpd.conf
#CustomLog logs/access_log common
[root@oldboy logs]#sed -i 's@#CustomLog logs/access_log
common@CustomLog /app/logs/access_log common@g' /etc/httpd/conf/httpd.conf
[root@oldboy logs]# grep "CustomLog /app/logs/access_log"/etc/httpd/conf/httpd.conf
CustomLog /app/logs/access_log common
#==》 创建一个模拟的分区/dev/sdb，block大小8K
[root@oldboy ~]# dd if=/dev/zero of=/dev/sdb bs=8k count=10
10+0 records in
10+0 records out
81920 bytes (82 kB) copied, 0.000203364 s,403 MB/s
#==》 格式化/dev/sdb为ext3系统文件格式
[root@oldboy ~]# mkfs -t ext3 /dev/sdb
#==》 创建一个/dev/sdb挂载点/app/logs
[root@oldboy ~]# mkdir -p /app/logs
#==》 把/dev/sdb挂载到/app/logs
[root@oldboy ~]# mount -o loop /dev/sdb /app/logs/
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
[root@oldboy ~]# ls -l /app/logs/
total 12
drwx------ 2 root root 12288 Nov 16 19:27lost+found
#==》 重启httpd服务使配置文件生效
[root@oldboy ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: apr_sockaddr_info_get()failed for oldboy
httpd: Could not reliably determine theserver's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@oldboy ~]# cat /app/logs/access_log
#==》 把httpd服务首页内容修改成oldboy
[root@oldboy ~]# echo oldboy > /var/www/html/index.html
#==》 访问httpd服务，使其产生日志记录
[root@oldboy ~]# curl 127.0.0.1
oldboy
[root@oldboy ~]# cat /app/logs/access_log
127.0.0.1 - - [16/Nov/2018:19:33:26 +0800]"GET / HTTP/1.1" 200 7
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 15K 54K 22% /app/logs
#==》 打开一个新SSH窗口，使用这条命令自动刷访问，把tomcat的记录日志access_log增大，撑满/dev/sdb分区容量
[root@oldboy ~]# for n in `seq 1000`;do curl 127.0.0.1;done
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 71K 0 100% /app/logs
#==》 删除/app/logs记录日志文件
[root@oldboy ~]# find /app/logs/ -type f -name "access_log"-delete
root@oldboy ~]# ls -lh /app/logs/
total 12K
drwx------ 2 root root 12K Nov 16 19:27lost+found
#==》 查看/dev/sdb分区容量依然爆满
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
解决办法1：重启httpd服务
标注：使用这种办法是因为进程正在调用access_log记录日志文件，直接删除并不能直接删除这个文件，只能重启httpd服务释放，建议使用下面的解决办法2
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
[root@oldboy ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd:apr_sockaddr_info_get() failed for oldboy
httpd: Could not reliably determine theserver's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
解决办法2：不删除access_log文件，直接清空access_log文件内容
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
[root@oldboy ~]# > /app/logs/access_log
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
