How to check file that delete and still used by process
run following command
pc-dev:~ # lsof +L1
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
nscd 835 nscd 9u REG 0,18 217032 0 12018 /run/nscd/dbPubUiG (deleted)
nscd 835 nscd 10r REG 0,18 217032 0 12018 /run/nscd/dbPubUiG (deleted)
gnome-she 1406 pcadmin 36r REG 8,3 56 0 67174168 /home/pcadmin/.local/share/gvfs-metadata/root (deleted)
gnome-she 1406 pcadmin 38r REG 8,3 32768 0 67174169 /home/pcadmin/.local/share/gvfs-metadata/root-621212d6.log (deleted)
pc-dev:~ #