***了解Linux文件删除原理先了解一下文件inode索引节点，每个文件在Linux系统里都有唯一的索引节点（身份证号）
inode。如果文件存在硬链接，那这个文件和这个文件的硬链接的inode是相同的，并且可以创建许多硬链接。
参照了解inode索引节点 博客 https://www.cnblogs.com/zoulongbin/p/10456285.html
[root@oldboy test]# ls -li
total 0
140028 -rw-r--r-- 1 root root 0 Nov 16 17:25 file.txt
[root@oldboy test]# ln file.txt /tmp/file_hard_link1.txt
[root@oldboy test]# ln file.txt file_hare_link2.txt
[root@oldboy test]# ls -lih file.txt file_hare_link2.txt /tmp/file_hard_link1.txt
140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 file_hare_link2.txt
140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 file.txt
140028 -rw-r--r-- 3 root root 0 Nov 16 17:25 /tmp/file_hard_link1.txt
一个文件被删除需要满足两个条件：
i_link 硬链接数为0 并且 i_count 进程引用计数也为0，文件才算被删除，否则文件不能说被删除。
文件没被删除，文件的inode索引结点号系统是没有回收的，文件只有完全被删除了后，系统才
会回收文件inode索引节点，而后被创建的新文件使用。
实验
1、创建两文件之前先df –i查看分区inode，创建两个文件，一个file.txt，
内容testfile，另一个文件text.txt，内容abcdef，再查看分区inode变化
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55834 537510 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# echo "testfile" > file.txt
[root@oldboy test]# echo "abcdef" > text.txt
[root@oldboy test]# ls -l
total 8
-rw-r--r-- 1 root root 9 Nov 16 18:22 file.txt
-rw-r--r-- 1 root root 7 Nov 16 18:23 text.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
2、创建硬链接对inode大小没有影响
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ln file.txt file_hard_link.txt
[root@oldboy test]# ln text.txt text_hard_link.txt
[root@oldboy test]# ls -lih
total 16K
140028 -rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt
140028 -rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt
140787 -rw-r--r-- 2 root root 7 Nov 16 18:23 text_hard_link.txt
140787 -rw-r--r-- 2 root root 7 Nov 16 18:23 text.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
3、删除text.txt文件本身外还要删除硬链接文件，这样才text.txt文件才算被删除
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# find /test/ -type f -name "text.txt" -delete
[root@oldboy test]# ls -l
total 12
-rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt
-rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt
-rw-r--r-- 1 root root 7 Nov 16 18:23 text_hard_link.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55836 537508 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# find /test/ -type f -name "text_hard_link.txt" -delete
[root@oldboy test]# ls -l
total 8
-rw-r--r-- 2 root root 9 Nov 16 18:22 file_hard_link.txt
-rw-r--r-- 2 root root 9 Nov 16 18:22 file.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
4、使用vim file.txt打开文件，然后打开另一个SSH删除file.txt和file_hard_link.txt后观察分区inode
[root@oldboy test]# vim file.txt
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ls
file_hard_link.txt file.txt
[root@oldboy test]# find /test/ -type f -delete
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55835 537509 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
[root@oldboy test]# ##退出file.txt编辑模式
[root@oldboy test]# ls
file.txt
[root@oldboy test]# find /test/ -type f -delete
[root@oldboy test]# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sda3 593344 55834 537510 10% /
tmpfs 125596 1 125595 1% /dev/shm
/dev/sda1 51200 38 51162 1% /boot
企业案例1：Web服务器磁盘分区爆满故障深入解析
原因：
tomcat记录日志access_log过大导致分区爆满，直接删除了tomcatl日志文件access_log，删除access_log记录日志文件后使用df –h查看磁盘分区还是爆满。
创建模拟场景：
##yum安装httpd(tomcat)
[root@oldboy ~]# yum -y install httpd
[root@oldboy ~]# rpm -qa httpd
httpd-2.2.15-69.el6.centos.x86_64
##启动httpd服务
[root@oldboy ~]# /etc/init.d/httpd start
Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
##查看htttpd是否运行
[root@oldboy ~]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 2812 root 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2814 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2815 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2816 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2817 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2818 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2819 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2820 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
httpd 2821 apache 4u IPv6 15539 0t0 TCP *:http (LISTEN)
##关闭防火墙
[root@oldboy ~]# /etc/init.d/iptables stop
##修改httpd服务配置文件httpd.conf日志存放路径
[root@oldboy ~]# grep "#CustomLog logs/access_log" /etc/httpd/conf/httpd.conf
#CustomLog logs/access_log common
[root@oldboy logs]#sed -i 's@#CustomLog logs/access_log common@CustomLog /app/logs/access_log common@g' /etc/httpd/conf/httpd.conf
[root@oldboy logs]# grep "CustomLog /app/logs/access_log" /etc/httpd/conf/httpd.conf
CustomLog /app/logs/access_log common
##创建一个模拟的分区/dev/sdb，block大小8K
[root@oldboy ~]# dd if=/dev/zero of=/dev/sdb bs=8k count=10
10+0 records in
10+0 records out
81920 bytes (82 kB) copied, 0.000203364 s, 403 MB/s
##格式化/dev/sdb为ext3系统文件格式
[root@oldboy ~]# mkfs -t ext3 /dev/sdb
##创建一个/dev/sdb挂载点/app/logs
[root@oldboy ~]# mkdir -p /app/logs
#把/dev/sdb挂载到/app/logs
[root@oldboy ~]# mount -o loop /dev/sdb /app/logs/
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
[root@oldboy ~]# ls -l /app/logs/
total 12
drwx------ 2 root root 12288 Nov 16 19:27 lost+found
##重启httpd服务使配置文件生效
[root@oldboy ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@oldboy ~]# cat /app/logs/access_log
##把httpd服务首页内容修改成oldboy
[root@oldboy ~]# echo oldboy > /var/www/html/index.html
##访问httpd服务，使其产生日志记录
[root@oldboy ~]# curl 127.0.0.1
oldboy
[root@oldboy ~]# cat /app/logs/access_log
127.0.0.1 - - [16/Nov/2018:19:33:26 +0800] "GET / HTTP/1.1" 200 7
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 15K 54K 22% /app/logs
##打开一个新SSH窗口，使用这条命令自动刷访问，把tomcat的记录日志access_log增大，撑满/dev/sdb分区容量
[root@oldboy ~]# for n in `seq 1000`;do curl 127.0.0.1;done
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 71K 0 100% /app/logs
##删除/app/logs记录日志文件
[root@oldboy ~]# find /app/logs/ -type f -name "access_log" -delete
root@oldboy ~]# ls -lh /app/logs/
total 12K
drwx------ 2 root root 12K Nov 16 19:27 lost+found
##查看/dev/sdb分区容量依然爆满
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
解决办法1：重启httpd服务
标注：使用这种办法是因为进程正在调用access_log记录日志文件，直接删除并不能直接删除这个文件，只能重启httpd服务释放，建议使用下面的解决办法2
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
[root@oldboy ~]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: httpd: apr_sockaddr_info_get() failed for oldboy
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
[ OK ]
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
解决办法2：不删除access_log文件，直接清空access_log文件内容
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 73K 0 100% /app/logs
[root@oldboy ~]# > /app/logs/access_log
[root@oldboy ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 8.8G 1.5G 7.0G 17% /
tmpfs 491M 0 491M 0% /dev/shm
/dev/sda1 190M 36M 145M 20% /boot
/dev/sdb 73K 14K 55K 21% /app/logs
感谢老男孩博客提供参考 https://blog.51cto.com/oldboy