What does the “count” entry in an inode track?

The count value reflects how many times the file has been opened without being closed (in other words, how many references to the file are still active.

This has some ramifications which aren’t obvious at first: you can delete a file so that no “filename” part points to the inode, without releasing the space for the data part of the file, because the file is still open.

Related: Have you ever found yourself in this position: you notice that /var/log/messages (or some other syslog-owned file) has grown too big, and you rm /var/log/messages || touch /var/log/messages to reclaim the space, but the used space doesn’t reappear?

Why is that?

(This is because, although you’ve deleted the filename part, there’s a process that’s got the data part open still (syslogd), and the OS won’t release the space for the data until the process closes it.

In order to complete your space reclamation, you have to do something like :

kill -SIGHUP `cat /var/run/syslogd.pid` to get syslogd to close and reopen the file.