CentOS - Feb 2010 - very large difference between df and du (10 GB, hard to believe)

Hello,

I have a small server running a tool (RT : perl + mysql + apache) for our
support team. I stripped down everything else. The OS is
CentOS 4.8. I noticed a difference between df and du which is hard to believe :

according to df, I am using 29 GB


[root at cedrat-rt ~]$ df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda1              33G   29G  2.8G  92% /
none                  506M     0  506M   0% /dev/shm

(there are no other partitions - ok, I could have partitioned it a bit more)

but according to 

du -kshxc /*

my largest directory is /var (because of mysql) and the grand total is

19 GB

I have a 10 GB difference between both outputs.

I verified with

tune2fs -l /dev/sda1
(...)
Block count:              8703205
Reserved block count:     435160

that is, the ordinary 5%

the journal size :

debugfs -R "stat <8>" /dev/sda1

yields 

Size: 33554432 with a block size of 4096, this gives 128 MB

I rebooted on the CentOS v4.8 CD #1, started "linux rescue" :

mounting /dev/sda1, I get the same 29 GB used

e2fsck reports a clean filesystem

e2fsck -f does not reports further errors.

Does anybody have a suggestion ?

Best regards
---
Robert GRASSO - System engineer

On Mon, Feb 1, 2010 at 8:29 AM, Robert Grasso
<robert.grasso+nv at cedrat.com> wrote:
> Hello,
>
> I have a small server running a tool (RT : perl + mysql + apache) for our
support team. I stripped down everything else. The OS is
> CentOS 4.8. I noticed a difference between df and du which is hard to
believe :
>
> according to df, I am using 29 GB
>
>
> [root at cedrat-rt ~]$ df -h
> Filesystem ? ? ? ? ? ?Size ?Used Avail Use% Mounted on
> /dev/sda1 ? ? ? ? ? ? ?33G ? 29G ?2.8G ?92% /
> none ? ? ? ? ? ? ? ? ?506M ? ? 0 ?506M ? 0% /dev/shm
>
> (there are no other partitions - ok, I could have partitioned it a bit
more)
>
> but according to
>
> du -kshxc /*
>
> my largest directory is /var (because of mysql) and the grand total is
>
> 19 GB
>
> I have a 10 GB difference between both outputs.
>
> I verified with
>
> tune2fs -l /dev/sda1
> (...)
> Block count: ? ? ? ? ? ? ?8703205
> Reserved block count: ? ? 435160
>
> that is, the ordinary 5%
>
> the journal size :
>
> debugfs -R "stat <8>" /dev/sda1
>
> yields
>
> Size: 33554432 with a block size of 4096, this gives 128 MB
>
> I rebooted on the CentOS v4.8 CD #1, started "linux rescue" :
>
> mounting /dev/sda1, I get the same 29 GB used
>
> e2fsck reports a clean filesystem
>
> e2fsck -f does not reports further errors.
>
> Does anybody have a suggestion ?
>
> Best regards
> ---
> Robert GRASSO - System engineer
>
>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>
This is typical.  There were probably files deleted from the file
system that are still in use by a process.  Restarting the process
will release the files and df and du will jive.

Robert Grasso wrote, On 02/01/2010 10:29 AM:
> Hello,
<SNIP>
> CentOS 4.8. I noticed a difference between df and du which is hard to
believe :
> 
> according to df, I am using 29 GB
> [root at cedrat-rt ~]$ df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda1              33G   29G  2.8G  92% /
> none                  506M     0  506M   0% /dev/shm
> 
> (there are no other partitions - ok, I could have partitioned it a bit
more)
> but according to 
> 
> du -kshxc /*
> my largest directory is /var (because of mysql) and the grand total is
> 19 GB
> 
> I have a 10 GB difference between both outputs.
<SNIP>
> e2fsck reports a clean filesystem
<SNIP>
> Does anybody have a suggestion ?
<commentary on options>
-k is 1k block size
-h is print human readable (with appropriate extensions)
which ever of them is last wins for display... I suggest only using one though,
to reduce possible
confusion.
for large measurements I usually use -m,
of course it could be fun to use --block-size=1024M instead, i.e., 1G.
</commentary on options>

I too would expect them to come close to matching, unless you have a lot of 3.5k
(or less) files in
a 4k inode file system.

du -shxc --count-links /*
du -shxc --apparent-size /*
du -shxc --count-links --apparent-size /*

-- 
Todd Denniston
Crane Division, Naval Surface Warfare Center (NSWC Crane)
Harnessing the Power of Technology for the Warfighter

Robert Grasso wrote:
> Hello,
> 
> I have a small server running a tool (RT : perl + mysql + apache) for our
support team. I stripped down everything else. The OS is
> CentOS 4.8. I noticed a difference between df and du which is hard to
believe :
> 

Did you mount something such as an NFS share over a directory that has 
stuff in it?

Ryan