vmware-se 4454 root 0u CHR 136,0 2 /dev/pts/0 (deleted)
gdm-binar 4506 root 0u CHR 136,0 2 /dev/pts/0 (deleted)
gconfd-2 5392 root 12wW REG 253,0 609 13090818 /tmp/gconfd-root/lock/0t1188207163ut519551u0p5392r346479926k3219784492 (deleted)
vmware-vm 5822 root 57u REG 253,0 6520832 13074477 /tmp/vmware-root/ram0 (deleted)
vmware-vm 16487 root 57u REG 253,0 11153408 13074520 /tmp/vmware-root/ram0 (deleted)
kdeinit 17991 root 17u REG 253,0 26712 13074524 /tmp/kde-root/khtmlcacheM7jXYb.tmp (deleted)
kdeinit 17991 root 18u REG 253,0 5631 13074501 /tmp/kde-root/khtmlcacheZlJmda.tmp (deleted)
kdeinit 17991 root 21u REG 253,0 44718 13074514 /tmp/kde-root/khtmlcacheH5m4lc.tmp (deleted)
In the example above, the 7th column in the output denotes the size of deleted files (in bytes). The 9th column denotes which file remains held open. The 1st and second columns denotes the process and pid that still holds the open file descriptor.
之所以df和du命令看到的空间使用会有差别，原因在于du不统计已经删除的文件，df会统计已经删除的文件，但该文件依然被进程持有，只有等进程释放了该文件，df才不进行统计。通过lsof | grep deleted命令可以找出被删除的文件依然被进程持有的情况。
通过上面这篇文章我们得知，在文件系统中删除某个大文件空间没有释放是因为依然有进程在持有它，如果找到相关进程就需要用到lsof命令和fuser命令，熟悉这两个命令非常的重要。
>lsof(list open files)是一个列出当前系统打开文件的工具。
>fuser用于标识访问文件或socket的进程信息。
fuser也是我们平时常用的找进程的工具，但它不能列出详细的进程信息，更多的只是一个进程号，无法很好的过滤，在这个场景中lsof工具更加的合适。
另外，大家都知道，在Linux平台文件系统中，即使某个文件被删除，但是它如果任然有进程持有它，这个文件是可以被恢复的，这就是为什么数据库所有数据文件被删除，在实例没有停机的情况下可以完整恢复数据文件的原因，下面这篇MOS文章就讨论了在此情况下如何对数据文件进行恢复：
How To Recover Deleted Files on ext3/ext4 Filesystem (文档 ID 2056343.1)
In this Document
Applies to:
Linux OS - Version Oracle Linux 5.0 and later
Linux x86-64
Linux x86
Goal
How to recover deleted file on ext3/ext4 filesystem, Which still has file descriptor opened.
Solution
A file in Linux is a pointer to an inode which contains the file data (permissions, owner and where its actual content resides on the disk).
Deleting the file removes the link, but not the inode itself.
If any other process has this file open then inode is not released for writing until the process releases it.
So if a process still has the file open, the data are there somewhere, even though the directory listing shows no files.
# ll
total 4
-rw-r--r-- 1 root root 27 Sep 16 05:19 test
# rm test
# lsof /opt/test/test
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME