1

run:

lsof|grep delete

can find some process open fd, but system said that it has been deleted:

mingetty 2031 root txt REG 8,2 15256 49021039 /sbin/mingetty (deleted)

I look in the /proc filesystem:

ls -l /proc/[pid]

lrwxrwxrwx 1 root root 0 9月  17 16:12 exe -> /sbin/mingetty (deleted)

but actually, the executable(/sbin/mingetty) is normal at /sbin/mingetty path.

and some sockets show this situation:

ls -l /proc/[pid]/fd

82 -> socket:[23716953]

but, using the commands: netstat -ae|grep [socket id] can find it.

why does the OS display this information??

Soham Chakraborty
  • 3,534
  • 16
  • 24
liutaihua
  • 11
  • 1

1 Answers1

4

Perhaps you ran yum update, mingetty got upgraded and the exe you are observing is the old, actually deleted version.

As you might or might not know, in Linux some file does not get deleted until all the file handles using the file are closed. The old mingetty is still running and keeping the file handles.

Janne Pikkarainen
  • 31,454
  • 4
  • 56
  • 78
  • I don't think so. I run yum update, but the problem still. and how to resolve the socket dis "deleted"? – liutaihua Sep 20 '12 at 02:25
  • @janne-pikkarainen is correct. To resolve the (very minor) problem, do a ps to find the pids of the mingetty processes, and kill them. You may want to be careful if you are actually using the linux console to access your machine, and you may want to kill just one and check that a new one appears in its place with another PID, this is as it should be. When you have killed all of the old ones, you will no longer see the `deleted` in lsof. You can also reboot; since you asked this question more than three years ago I have no doubt that you have already done so and solved your problem in that way. – Law29 Dec 17 '15 at 16:12
  • https://unix.stackexchange.com/questions/197854/how-does-the-proc-pid-exe-symlink-differ-from-ordinary-symlinks – wcc526 May 27 '19 at 06:31