Jan 112008

If you are an UNIX/LINUX administrator then you would have possibly come across or will see quite regularly that DU and Df do not always agree on the size of the filesystem when measured with most of the file systems. In most known scenarios, df will be reporting less available space than the du command.

The du command checks rather counts file by file and thereby count the total space on it

On the other hand, the df command directly calls the filesystem and queries the current disk space used. The super blocks of the file system provides this information.

The possible causes could be as follows:

i. Processes with open file which does not exist or has been deleted from the filesystem

A most common example would be a log file to which a process keeps writing continously. When the file is deleted, the process keeps running and the space is not freed (the process keeps the file open).

The disk blocks associated with the file are actually deleted and made available for reuse when the last  reference to the file is removed. When a Unix process opens a file, the reference count to that file is incremented.  Subsequently, if the file itself is removed from the filesystem, the data blocks remain in use until the process closes the file, either either when stops itself or is killed.

Under these conditions, du will be unable to see the file in the filesystem and therefore will not count its size, but df in getting the answer from the filesystem beleives the file still exists.

When the process closes the file either when it quits or is killed, or when the machine is rebooted, the disk blocks will return to the free list and du and df will see the actual size. In most cases, an unmount and remount (or a reboot) will fix the problem.

ii. Inconsistent file system requiring fsck

If the filesystem becomes corrupt/inconsistent for some reason then there can be a problem. What can be seen by a process looking at the filesystem (du), does not match up with the view the filesystem itself has (df).
In this situation a fsck should help. Boot from the CD and run a FSCK take down the system to Single User mode and run a fsck.

iii. Mount point containing data

If a mount point already contains data, the du process will be unable to see this data (sees only the mounted filesystem), but the underlying filesystem will still keep track of this data, consequently df will report the extra disk space in use.

Unmounting the filesystem will reveal the data.  However, if the mounted filesystem is being used by running processes it will not be possible to unmount it.  Either identify and kill the processes (fuser), or reboot in single user mode to check the mount point directory.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>