LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 09-20-2016, 12:55 PM   #1
BCarey
Senior Member
 
Registered: Oct 2005
Location: New Mexico
Distribution: Slackware
Posts: 1,639

Rep: Reputation: Disabled
huge difference between du and df


Hi all,

I had a system (slack64 14.1) crash this morning and I couldn't start X on reboot. Turns out my / filesystem was full, as reported by df. So, trying to clear things up, I used du to find out where the bloat was. Unfortunately, du seemed to find a lot less used space than du reported.

To be more specific, "du -xsh " showed 22G used while "df -h" showed 28G used. Since the filesystem was on lvm I was able to increase the volume size to solve my immediate problem, but the discrepancy between du and df still exists. I have run fsck on the root filesystem, which reports all okay. I have rebooted to ensure that no running processes could be still claiming deleted files. Never-the-less I still have this non-trivial discrepancy. Any ideas about how to research further?

Thanks,
Brian
 
Old 09-20-2016, 01:05 PM   #2
Richard Cranium
Senior Member
 
Registered: Apr 2009
Location: Carrollton, Texas
Distribution: Slackware64 14.2
Posts: 3,748

Rep: Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085
I assume that du does not account for the metadata associated with a file whereas df does.
 
Old 09-20-2016, 01:09 PM   #3
BCarey
Senior Member
 
Registered: Oct 2005
Location: New Mexico
Distribution: Slackware
Posts: 1,639

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Richard Cranium View Post
I assume that du does not account for the metadata associated with a file whereas df does.
Could that really account for a 6G (21-27%) difference?
 
Old 09-20-2016, 01:22 PM   #4
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: CentOS 7
Posts: 3,532

Rep: Reputation: 974Reputation: 974Reputation: 974Reputation: 974Reputation: 974Reputation: 974Reputation: 974Reputation: 974
du reports allocated disk usage. df reports filesystem space available to a non-root user. df does not include reserved space as available.
 
Old 09-20-2016, 01:31 PM   #5
phenixia2003
Senior Member
 
Registered: May 2006
Location: France
Distribution: Slackware
Posts: 1,012

Rep: Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979
Hello,

By default, 5% of disk space is reserved. 28-22=6 => 5%(X)=6G => X=120G



--
SeB
 
Old 09-20-2016, 01:33 PM   #6
BCarey
Senior Member
 
Registered: Oct 2005
Location: New Mexico
Distribution: Slackware
Posts: 1,639

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by phenixia2003 View Post
Hello,

By default, 5% of disk space is reserved. 28-22=6 => 5%(X)=6G => X=120G



--
SeB
But this partition was only 30G, not 120G, so 5% would only be 1.5G. Since I expanded the file system to 50G, I'm getting identical results from df and du. Reserved space would still only account for 2.5G, which still leaves a huge amount "unaccounted" for.

Last edited by BCarey; 09-20-2016 at 01:37 PM.
 
Old 09-20-2016, 01:49 PM   #7
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,535

Rep: Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077Reputation: 2077
That difference is almost always due to a huge deleted file still held open by some process, often a big log file. You can run (as root)
Code:
lsof | grep '(deleted)' | less
and scroll down looking for something huge.

If you have rebooted and still see the problem, then "fsck -f" on the filesystem is warranted.

And, now that I see you've already done that, about the only remaining possibility is files hidden under an active mount point. Try this
Code:
mkdir /tmp/tmpmnt
mount --bind / /tmp/tmpmnt
du /tmp/tmpmnt

Last edited by rknichols; 09-20-2016 at 01:56 PM. Reason: And, not that I see ...
 
2 members found this post helpful.
Old 09-20-2016, 02:03 PM   #8
phenixia2003
Senior Member
 
Registered: May 2006
Location: France
Distribution: Slackware
Posts: 1,012

Rep: Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979Reputation: 979
Quote:
Originally Posted by BCarey View Post
But this partition was only 30G, not 120G, so 5% would only be 1.5G. Since I expanded the file system to 50G, I'm getting identical results from df and du. Reserved space would still only account for 2.5G, which still leaves a huge amount "unaccounted" for.
I've had an issue like that, but without crash, and without lvm. I've found there was huge files in hidden folders and large files (~20M) in folder like /var/tmp/kdecache-seb with commands below :

Code:
$ du -h ~ | grep -E "^[[:digit:]]+[G]"
$ du -h /var/tmp | grep -E "^[[:digit:]]+[G]"
$ du -h /tmp | grep -E "^[[:digit:]]+[G]"

$ du -h ~ | grep -E "^[[:digit:]]{2}[M]"
$ du -h /var/tmp | grep -E "^[[:digit:]]{2}[M]"
$ du -h /tmp | grep -E "^[[:digit:]]{2}[M]"
--
SeB
 
Old 09-20-2016, 02:05 PM   #9
BCarey
Senior Member
 
Registered: Oct 2005
Location: New Mexico
Distribution: Slackware
Posts: 1,639

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by rknichols View Post
And, now that I see you've already done that, about the only remaining possibility is files hidden under an active mount point. Try this
Code:
mkdir /tmp/tmpmnt
mount --bind / /tmp/tmpmnt
du /tmp/tmpmnt
This looks promising. When doing this du reported the 28G. So I will investigate that. Thank you very much.

Brian
 
Old 09-21-2016, 10:37 AM   #10
BCarey
Senior Member
 
Registered: Oct 2005
Location: New Mexico
Distribution: Slackware
Posts: 1,639

Original Poster
Rep: Reputation: Disabled
So indeed there were 6 Gigs of files hiding under one of the mounts. Thank you rknichols for pointing to the solution. Thank you also phenixia for your efforts on my behalf. Now both df and du report 22G used, not even a discrepancy d/t reserved space.

Brian
 
Old 08-23-2019, 12:10 AM   #11
saurabhve
LQ Newbie
 
Registered: Dec 2011
Posts: 1

Rep: Reputation: Disabled
Thumbs up

Quote:
Originally Posted by rknichols View Post
That difference is almost always due to a huge deleted file still held open by some process, often a big log file. You can run (as root)
Code:
lsof | grep '(deleted)' | less
and scroll down looking for something huge.

If you have rebooted and still see the problem, then "fsck -f" on the filesystem is warranted.

And, now that I see you've already done that, about the only remaining possibility is files hidden under an active mount point. Try this
Code:
mkdir /tmp/tmpmnt
mount --bind / /tmp/tmpmnt
du /tmp/tmpmnt


binding the mount showed up that there was a local directory which had some used space and at some point of time this directory was mounted to some different disk partition, thus leaving behind the old data in the previous partition.
 
Old 08-23-2019, 01:41 AM   #12
Richard Cranium
Senior Member
 
Registered: Apr 2009
Location: Carrollton, Texas
Distribution: Slackware64 14.2
Posts: 3,748

Rep: Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085Reputation: 2085
"Better late than never" isn't always true.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Huge difference between ext4 3TB partitions jaccoruns Linux - Kernel 3 01-17-2013 02:18 AM
du vs df -- Huge difference; Disk Space Vanishing zok Linux - General 5 09-04-2012 02:13 PM
Same font in 2 machines - huge difference in aspect romagnolo Linux - Software 5 03-18-2012 06:22 PM
Slackware 13.37, what is the difference between huge.s and hugemps.s kernels ? zeelog Slackware 2 05-26-2011 09:47 AM
Difference between the hugesmp.s and huge.s kernel C-Sniper Slackware 6 05-18-2008 09:19 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 05:28 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration