This happens frequently with the way df reads disk usage statistics by using file descriptors. Follow this example to see what I'm talking about.
You have a 10GB partition for /var/.
You have an application that spawns a process that logs data to /var/app/log which is always running and will rotate/remove old log files as needed.
Your process has created several log files of 1GB each /var/app/log.1 /var/app/log.2 that totals to 9GB. Your process sees this and removes 5 old log files to bring you down to 4GB of total disk space consumption.
You run du on /var/ and it comes back with 4GB.
You run df -h and /var/ shows using 9GB still.
You kill your logging process which allows df to read the new file descriptors since the process is no longer using them and reports the statistics correctly.
Excerpt from link below
df will include open files (in memory, but not on disk), data/index files (used for data management - sometimes using approximately 2 to 5% of each filesystem) and unnamed files in its size calculation. This is one reason why, sometimes (although not very often), df can show a larger amount of disk used than du does.
Check out
http://linuxshellaccount.blogspot.co...nt-values.html
at the end of the day trust du and not df if you have to choose which one is more correct.