Add disk full incident response toolkit

2026-05-05 21:44:08 +00:00
parent 5dd8c34952
commit 76e24796bb
10 changed files with 742 additions and 0 deletions
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=00_env.sh
+. "$SCRIPT_DIR/00_env.sh"
+
+section "Deleted But Open Files"
+
+if ! require_cmd lsof; then
+  warning "lsof is not installed or not in PATH. Install lsof or run equivalent tooling with appropriate privileges."
+  exit 0
+fi
+
+warning "Read-only check. Full results may require elevated privileges."
+
+deleted_output="$(lsof -nP +L1 2>/dev/null || true)"
+
+if [[ -z "$deleted_output" ]]; then
+  ok "No deleted open files detected by lsof."
+  exit 0
+fi
+
+printf '%s\n' "$deleted_output" |
+  awk '
+    NR == 1 {
+      printf "%-20s %-10s %-12s %s\n", "PROCESS", "PID", "SIZE", "PATH"
+      next
+    }
+    {
+      path = $9
+      for (i = 10; i <= NF; i++) {
+        path = path " " $i
+      }
+      printf "%-20s %-10s %-12s %s\n", $1, $2, $7, path
+    }
+  ' | tee -a "$LOG_FILE"
+
+warning "Space from deleted files is released when the owning process closes the file or is safely restarted."