Just run fuser -V -d on the filesystem you want to check for deleted but still opened files. This is an example for /tmp:

# fuser -V -d /tmp
/tmp:
inode=7 size=56 fd=2 512238

The PID points to the process which still has an open file descriptor to the deleted file:

# ps -fp 512238
USER PID PPID C STIME TTY TIME CMD
root 512238 1 0 Mar 20 – 3:29 /usr/sbin/rsct/bin/ctcasd

Advertisements