Open multiple files with vim

There are many instances when it’s useful to have multiple files open in vim, but if you aren’t familiar with this tool you can find yourself needlessly jumping around between multiple windows. If you are doing any type of real systems work on a Linux operating system I suggest that you familiarize yourself with vim. If you are not already using vim start by opening a command prompt and type vimtutor, once you’ve become familiar with how to navigate, search, and edit a document with vim this post will make more sense to you.

Use vim to see what is different between two files

There are several ways to find differences between two files on a Linux server or desktop. I like to use vim when I’m scanning a configuration file for recent changes from an earlier iteration ( assuming of course that there is a backup of the last known, good, configuration).

Comparing two files is a common task and there are several ways to view the differences between multiple files, but occasionally you may want to do this visually side by side.

Continue reading “Open multiple files with vim”

How to RTFM (Read the *#&@ Manual)

Finding help with Linux

If you hang out in enough Linux forums asking questions sooner or later someone will tell you to read the manual (presumably they think this will help you). Fortunately, over the last few years “rtfm” has ceased being the default answer to questions from new users. All things considered the Linux world has become more user friendly, even if the man pages haven’t.

One of the things that will allow you to separate yourself from new and even some intermediate users is knowing where to find the help you need on your own, knowing how to read the information you find, and then being able to apply that information. Plus, if you plan to take any Linux exams you will need to know how to find and read man pages. There is simply no way that most of us can memorize all of the command and configuration options you need to pass a Red Hat or Linux Foundation exam.

Continue reading “How to RTFM (Read the *#&@ Manual)”

sudo bang bang

So a day or two ago a co-worker mentioned that you can do  sudo !! to execute the last command in your history as root. I had never heard of such a thing! My life has been changed forever!

Here I’ve been hitting the back arrow like a peasant just to put  sudo in front of a previous command.

Please use your new found powers responsibly.

What to do when df and du report different usage.

You may occasionally come across an issue where running df will produce output that disagree’s with the output of the du command. If you aren’t familiar with these two commands do see my post about filesystem and directory size. The reason for the difference in reported size is that df does not differentiate between files that are open in memory but have been deleted, or altered on the disk, whereas du will only see the files that are on the disk. You should recognize that these tools serve different functions and that you will need to rely on both of them to get a truly accurate portrayal of disk usage on your system.

Lets say you run  df -h to get an idea of how much space you have on each of the filesystems on your server or PC only to see that /var is 98% full, 9.8G out of 10G just to keep it simple. Like a good admin you run  du -h --max-depth=1 /var to find out which directories are the largest and may have files that need to be zipped up, moved, or deleted. The problem becomes apparent when  du returns that just 3G are in use on that filesystem. What do you do now?

Check for deleted files in memory.

Have you heard the old saying around the Unix world that “Everything is a file”. Well it’s true, everything in Unix, and by association Linux, is a file. This includes deleted files that now live as chunks of memory that are in use by a process.



You can view all open files on a system with the  lsof command, including deleted files that live in memory and are in use by a process (for example an old configuration file). For instance:

sudo lsof | grep root

will show you a full output of all the files currently in use by the root user. (Probably a lot of files). Running  sudo lsof | less will show you all of the open files on your system. It will look something like this. (I’m only grabbing the first 3 lines for brevity).

COMMAND     PID   TID             USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
systemd       1                   root  cwd       DIR              202,1     4096          2 /
systemd       1                   root  rtd       DIR              202,1     4096          2 /
systemd       1                   root  txt       REG              202,1  1577232     396000 /lib/systemd/systemd

Here you can see the command, the process id (PID), which user has the file open, the file descriptor (FD), the size in bytes, and the location. In our scenario we want to find out if there are any large files open that may have been deleted. We can find those files like this:

sudo lsof | grep -i deleted

Keep an eye on the 8th column which if you recall is the SIZE column. Once you identify your large files check which user has the file open (4th column), usually this will be a service account like www-data, apache, mysql. Or pay attention to the command column to identify the process or service that is using the old file. After you identify the offending process all you need to do is restart the service using  systemctl, service, or kill -HUP

In conclusion

Don’t panic, take a breath, and assess what you are seeing, think about how your tools work and what they are showing you. Above all don’t just start deleting things to free up space! The reason that df and  du are having a disagreement here is that  df see’s these deleted files along with their replacements and calculates the total disk usage,  du on the other hand only see’s the new file. Now that you know how to find the zombie files you shouldn’t have too much trouble bringing these two system tools back into agreement.