You will never notice something like this on FreeBSD or Linux Desktop home system or your personal UNIX or Linux workstation. However, sometime on a production UNIX server you will notice that both df (display free disk space) and du (display disk usage statistics) reporting different output. Usually df will output a bigger disk usage than du.
If Linux or UNIX inode is deallocated you will see this problem. If you are using clustered system (file system such as GFS) you may see this scenario commonly.
Note following examples are FreeBSD and GNU/Linux specific.
Following is normal output of df and du for /tmp filesystem:
# df -h /tmp
Output:
Filesystem Size Used Avail Capacity Mounted on /dev/ad0s1e 496M 22M 434M 5% /tmp
Now type du command:
# du -d 0 -h /tmp/
Output:
22M /tmp/
Why is there a mismatch between df and du outputs?
However, some time it reports different output (a bigger disk usage), for example:
# df -h /tmp/
Output:
Filesystem Size Used Avail Capacity Mounted on /dev/ad0s1e 496M 39M 417M 9% /tmp
Now type du command:
# du -d 0 -h /tmp/
Output:
22M /tmp/
As you see, both df and du reporting different output. Many new UNIX admin get confused with output (39M vs 22M).
Open file descriptor is main causes of such wrong information. For example if file called /tmp/application.log is open by third party application OR by a user and same file is deleted, both df and du reports different output. You can use lsof command to verify this:
# lsof | grep tmp
Output:
bash 594 root cwd VDIR 0,86 512 2 /tmp bash 634 root cwd VDIR 0,86 512 2 /tmp pwebd 635 root cwd VDIR 0,86 512 2 /tmp pwebd 635 root 3rW VREG 0,86 17993324 68 /tmp (/dev/ad0s1e) pwebd 635 root 5u VREG 0,86 0 69 /tmp (/dev/ad0s1e) lsof 693 root cwd VDIR 0,86 512 2 /tmp grep 694 root cwd VDIR 0,86 512 2 /tmp
You can see 17993324K file is open on /tmp by pwebd (our in house software) but deleted accidentally by me. You can recreate above scenario in your Linux, FreeBSD or Unixish system as follows:
First, note down /home file system output:
# df -h /home
# du -d 0 -h /home
If you are using Linux then use du as follows:
# du -s -h /tmp
Now create a big file:
# cd /home/user
# cat /bin/* >> demo.txt
# cat /sbin/* >> demo.txt
Login on other console and open file demo.txt using vi text editor:
# vi /home/user/demo.txt
Do not exit from vi (keep it running).
Go back to another console and remove file demo.txt
# rm demo.txt
Now run both du and df to see the difference.
# df -h /home
# du -d 0 -h /home
If you are using Linux then use du as follows:
# du -s -h /tmp
Login to another terminal and close vi.
Now close the vi and the root cause of the problem should be resoled, the du and df outputs should be correct.
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- 10 Greatest Open Source Software Of 2009
- My 10 UNIX Command Line Mistakes
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
- Top 5 Linux Video Editor Software
- Email this to a friend
- Download PDF version
- Printable version
- Comment RSS feed
- Last Updated: Aug/16/2007



{ 10 comments… read them below or add one }
Thank you so much, because your solution (although strange at first) worked perfectly on one of our servers that were stating 5.1 Go instead of 4.5 Go. Unfortunately, repeating the same operation on the second server that has the same problem didn’t worked. I’m stil looking for a solution.
Hello, I have the same problem, but the solution you proposed just don’t work for me.
I have my /var folder quite full : 2.7go of 2.8go, that’s what’s indicated by “df” command, while “du” states only 628mo… Nothing strange pointed out by “lsof”, only a few files of less than 1mo showed up.
Pretty annoying…
Thanks in advance for any help
hi
I have the same problem with TRUE64 Unix.
I have fileset as /usr which is showing me 3021256KB used after df -k & after du -k it is showing me 1648760KB.
Please give me solution to resolve this problem.
thanks a lot for this hint! It worked perfectly on my machine.
Hi
I have all the same. Does anybody know how to solve it?
I HAVE A PROBLEM . I HAVE A GRAPHIC MODE DOWN DUE TO APPARENTLY NOT ENOUGH SPACE TO LOAD IT … WHEN I TYPE df -h it shows me this
/dev/sda1 36G 35G 0 100% /
varrun 244M 104K 244M 1% /var/run
varlock 244M 0 244M 0% /var/lock
procbususb 244M 88K 244M 1% /proc/bus/usb
udev 244M 88K 244M 1% /dev
devshm 244M 0 244M 0% /dev/shm
lrm 244M 33M 211M 14% /lib/modules/2.6.20-15-generic/volatile
WHICH SHOWS I HAVE NOT ENOUGH SPACE LEFT FOR THE GRAPHIC PROCESS TO RUN
THEN RIGHT AT THE ROOT I TYPE THIS
sudo du -sk *|sort -rn
31170836 home
2226844 usr
2091700 var
151540 lib
17036 boot
10788 etc
6084 sbin
4912 bin
1324 root
104 dev
24 tmp
16 lost+found
12 media
12 fdir1
8 opt
4 srv
4 prueba3
4 mnt
4 initrd
0 vmlinuz
0 sys
0 proc
0 initrd.img
0 cdrom
WHICH SHOWS THAT MY HOME PARTION IS THE ONE CAUSING THE PROBLEM
NEXT I DO THIS
cd /home
sudo du -sk *|sort -rn
31169040 user1
940 user2
816 user3
20 user4
16 user5
WHICH SHOWS ME THAT DIR user1 IS USING LOTS OF SPACE
THEN I DO THIS
cd user1
sudo du -sk *|sort -rn
and it shows me this
808840 Desktop
67712 archive1
30168 archive2
16112 archive3
11556 archive4
4116 archive5
1504 archive6
1024 archive7
408 archive8
168 archive9
116 archive10
32 archive11
16 archive12
16 archive13
12 archive14
12 archive15
4 archive16
4 archive17
4 archive18
4 archive19
4 archive20
4 archive21
4 archive22
0 archive23
My problem IS THAT THE HEAVY ARCHIVES DON’T SEEM TO BE SHOWING THEMSELVES SO THAT I CAN ERASE THEM.. HOW CAN I LOCATE THEM?
Thank you, this was very helpful.
Hi,
I have a similar problem, on our server we have a lvm partition which shows with df -h command
/dev/mapper/VG01-LV01 549G 514G 7.3G 99% /u01
it shows 99 % used, whereas if i do du -sh the output is as follows.
du -sh /u01
39G /u01/
we checked the command as lsof and it show the deleted file with big size.
my question how to resolve the problem, how can i free up the space.
will a simple reboot solve it, as it is a production system i cannot just reboot the server.
Thanks in advance.
–Chetan
Awesome, learn something new every day!
lsof on my CentOS 5 server includes a handy note if a file with an open FD has been deleted:
# lsof -n -P | grep deletedrsync 29911 root 3r REG 8,17 15496725683 26230786 /an/old/file (deleted)
kill the process, problem solved!
Hi,
My problem is solved now, I restarted mysql service, and it cleared the space for filesystem.
Thanks
Chetan