From: Rodrigo Barbosa rodrigob@suespammers.org
Actually, there is another neat trick for rpm based systems. You see, rpm, prior to removing anything, will rename that to ${NAME}.OLD. So, libc.so.6 becomes libc.so.6.OLD, and then removed. As we all know, if that library is currently open by any running process, it won't be imediately removed (even tho you can't see it with a 'ls'). The trick is pretty simple: lsof | grep OLD That, of course, only aplies if you are doing everything using RPM (yum, redhat-update, apt-get).
That's because open file handles work in inode number, not filename. So you can rename things out-of-the-way for existing file handles, while creating a new file that will be opened for any new ones.
Devices, processes, etc... in UNIX pretty much have the same logic as files. Which is why I love UNIX -- everything acts like a file, with similar meta-data, etc...
-- Bryan J. Smith mailto:b.j.smith@ieee.org