rm -rf * on /
 

My roommates thought it would be funny to run that command on our home Debian server. We were going to do a reinstall anyway still kind of sucks though...

My question is one ran it and the other cancelled it shortly after (he says like 5-10 seconds). What I can't figure out is how everything is still running. I can run no commands at all from the terminal but everything else seems to be running. It is serving files, doing backups, etc. I assume everything will be lost when I reboot. Can anyone explain this behaviour to a newb?

Thanks!

well rm will just dereference the inodes. the data is still there, and if a file is already opened by a web server of something then data will continue to be written to that part of the disk.

So it will still function until over-written and/or rebooted?

Sure brings back memories. I was working with a guy who did just what you tried, only by accident. He thought he was in a sub dir, but he was in /.
He realized it 20 or 30 seconds later and control C'd to stop the recursive remove. :D
The system still responded to some commands and some things worked but we knew we were missing key files. We simply reinstalled and moved on.

Linux will surprise you sometimes, but you know you have a hosed system. I'd just reload like you originally planned.
No way I wound want to try to piece a system that has had that happen back together. Much easier to start from scratch.

Yep thats what I'm going to do. I was just curious as to how everything was still functioning. Thanks for the responses!

Files which are help open by processes will not be deleted (unlinked) until the last process with them open closes the file and any links from directories are removed. At this point the link count to the actual file on disk will drop to 0 and then the file will be removed.

When you reboot, these files will be un-available because the programs will have terminated and thus the files will become unlinked, and thus many of the programs now running will fail to re-start.