Du and DF in Linux

During the Linux operations, it is often found that the Du and DF return values are different, and occasionally the difference is significant.

In certain cases, DF may see the disk full, but du determines that the disk has a large amount of space left.

File system allocation Some of the disk blocks used to record some of its own data, such as I node, disk distribution map, indirect blocks, super blocks and so on. This data is not visible to most user-level programs, often referred to as meta data.

DF: command to figure out the total number of blocks and remaining blocks by looking at the file system disk block allocation graph. Actual disk usage of the reaction system.

Du: User-state program. Only part of the file system is counted, regardless of metadata.

So DF >= du

If the values of df and du differ significantly, it is possible that a program has specified the file output to a deleted file.

For example: While the program is running, the log file is deleted, and the program continues to output to the Filehandler that the original log points to, without terminating. Even if you create a new file with the same name, the original Filehandler is still written to the original file. In DF's view, disk growth still exists, but du appears to have deleted the file. After a long run, DF will see that the disk occupancy rate is much higher than DU.

At this point, the process can be terminated, and the deleted file Filehandler will be reclaimed and the file deleted.

If you do not know the process ID, you can query with Lsof

# Lsof | grep Delete

Original link: Du and DF-zero space in Linux

Du and DF in Linux