How to Truncate Files in Linux: Empty Files Without Deleting

A log file has grown to several gigabytes, and the service that writes to it is still running. You want the disk space back, but you do not want to delete the file and break the service. Truncating the file solves this.

Truncating a file means removing its contents without deleting the file itself. This is faster than deleting the file , recreating it, and setting the correct permissions and ownership . It also preserves the file’s inode, so any process that has the file open keeps writing to the same file.

This guide explains how to truncate files in Linux using shell redirection and the truncate command.

Quick Reference #

Shell Redirection #

The simplest method to truncate a file is to use the > shell redirection operator.

In Bash, you can use:

> filename

Zsh handles a redirection without a command differently. It runs cat in its place, and the prompt waits for input until you press Ctrl+D. The : (colon) builtin works in both shells. It is equivalent to true and produces no output:

: > filename

If the file exists , it is truncated to zero. If it does not exist, the file is created.

Instead of :, you can use any command that produces no output. Here is an example using cat to output the contents of /dev/null :

cat /dev/null > filename

Another option is echo with the -n flag, which tells echo not to append a newline:

echo -n > filename

Redirection with sudo #

To truncate a file you need write permissions on it. When using sudo , the elevated privileges do not apply to the redirection operator because the shell handles the redirect before sudo runs. For example, this will fail:

sudo cat /dev/null > /var/log/syslog

bash: /var/log/syslog: Permission denied

To work around this, run a new shell with sudo and execute the command inside it using the -c flag:

sudo sh -c '> /var/log/syslog'

Another option is to pipe empty output to the tee command with elevated privileges:

: | sudo tee /var/log/syslog > /dev/null

The truncate command avoids the problem. It opens the file itself, so sudo applies to it:

sudo truncate -s 0 /var/log/syslog

truncate Command #

The truncate command allows you to shrink or extend the size of a file to a given size. The general syntax for truncating a file to zero is:

truncate -s 0 filename

The -s 0 option sets the file size to zero bytes.

For example, to empty the Nginx access log:

sudo truncate -s 0 /var/log/nginx/access.log

Truncating to a Specific Size #

The truncate command can also set a file to a specific size. This is useful for creating fixed-size files or trimming a file to a certain length:

truncate -s 100M largefile.img

The suffixes K, M, G, and T use powers of 1024. Add a B to use powers of 1000 instead: 1K is 1024 bytes, and 1KB is 1000 bytes. If the file is smaller than the specified size, it is extended with null bytes. If it is larger, the extra data is lost.

Empty All Log Files #

Over time, your disk drive may get cluttered with large log files taking up large amounts of disk space. Before emptying anything, list the .log files in the /var/log directory and check their sizes:

ls -lh /var/log/*.log

The following command empties all of them:

sudo truncate -s 0 /var/log/*.log

To also empty log files in subdirectories, use find with sudo. A ** glob is not reliable here. The shell expands it as your user, not as root, and it silently skips directories that only root can read, such as /var/log/unattended-upgrades on Ubuntu.

Run find without an action first to see which files it matches:

sudo find /var/log -type f -name '*.log'

When the list looks right, add -exec to truncate every match:

sudo find /var/log -type f -name '*.log' -exec truncate -s 0 {} +

• -type f -name '*.log' - Matches regular files with names ending in .log.
• -exec truncate -s 0 {} + - Runs truncate on the matched files. The + passes many file names to each truncate call.

These commands do not touch the systemd journal in /var/log/journal. To shrink it, use the --vacuum-size option described in our journalctl guide .

For long-term log management, consider configuring logrotate to automatically rotate, compress, and remove old log files.

Troubleshooting #

Permission denied when using redirection with sudo
The shell processes the > redirect before sudo executes. Use sudo truncate -s 0 file, sudo sh -c '> file', or pipe to sudo tee instead. See Redirection with sudo above.

File grows again after truncation
If a process is still writing to the file in append mode, new log entries make it grow again. This is normal and does not mean truncation failed. Find the process with lsof filename before deciding whether it needs to be stopped or reconfigured.

A process without append mode can keep its old write position. Its next write lands at that offset, leaving a gap that reads as null bytes. The apparent size shown by ls -l grows again, while du -h filename shows the actual disk usage. This can happen with programs started with > redirection, such as nohup command > output.log &. For a command started this way, stop it, truncate the file, and restart it with >> so it writes in append mode.

truncate: cannot open 'file' for writing: No such file or directory
The truncate command creates a missing file automatically, but it cannot create missing parent directories. Check that all parent directories exist, including those in a symbolic link’s target path.

FAQ #

What is the difference between truncating and deleting a file?
Deleting removes the file entry from the filesystem. Truncating keeps the file (with its permissions, ownership, and inode) but removes all its contents, setting the size to zero.

Is it safe to truncate a log file while a service is running?
Usually, yes. The file descriptor remains valid. A process that writes in append mode continues writing to the now-empty file. A process without append mode keeps writing at its old position and leaves null bytes at the start of the file (see Troubleshooting ). Truncating is still safer than deleting and recreating the file, which can leave the process writing to a deleted inode.

What is the difference between > file and truncate -s 0 file?
Both empty the file. Shell redirection (> file) is shorter for interactive use. The truncate command is more readable in scripts and supports setting files to arbitrary sizes, not just zero. It also works directly with sudo. Redirection fails when the noclobber shell option is set, with a cannot overwrite existing file error. Use >| file to override it.

Can I truncate multiple files at once?
Yes. The truncate command accepts multiple file arguments or shell globs: truncate -s 0 file1.log file2.log or truncate -s 0 *.log.

Conclusion #

To truncate a file in Linux, use the redirection operator > filename for a quick one-liner or truncate -s 0 filename for scripts and non-zero sizes. Always verify the target file before truncating, as the operation is irreversible.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page