Reasons for and handling of inconsistent disk space usage for DF and du displays (disk space does not release after file deletion)

1. How to remember these two commands

du-DISK USage

df-DISK FRee

2. The working principle of DF and Du

The working principle of 2.1 du

The du command treats the statistic file individually by calling Fstat this system call to get the file size. Its data is based on file acquisition, so there is a lot of flexibility, not necessarily for a partition, you can cross multiple partitions. If there are a lot of files in the directory, Du speed will be slow.

Working principle of 2.2 DF

DF command to use the thing statfs this system call, directly read the partition's Super block information to get the partition usage. Its data is based on partitioned metadata, so it can only be used for the entire partition. Because DF directly reads the super block, the speed of running is not affected by the number of files.

3 Du and DF inconsistency simulations

A common inconsistency between DF and Du is the problem of file deletion. When a file is deleted, it is not visible in the file system directory, so du does not count it again. However, if there is a running process holding the handle to a file that has been deleted, the file will not actually be deleted on disk, and the information in the partition Super block will not change. So DF will still count the deleted file.

(1) Use of the current zoning sda1

[root@centos192 testdu]# df-h/dev/sda1
File system capacity has been used available with percent mount point
/DEV/SDA1 49G 776M 45G 2%/var

(2) Create a 1GB large file

[root@centos192 var]# dd If=/dev/zero of=myfile.iso bs=1024k count=1000
Recorded the 1000+0 reading.
Record the writing of 1000+0.
1048576000 bytes (1.0 GB) replicated, 24.0954 seconds, 43.5 mb/sec

(3) The use of partitioned sda1 at this time

DF Results:

[root@centos192 var]# df-h/dev/sda1
File system <span style= "WHITE-SPACE:PRE;" > </span> &nbsp; &nbsp; &nbsp; capacity &nbsp; used &nbsp; usable% mount point
/DEV/SDA1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;49g &nbsp;1.8g &nbsp; 44G &nbsp; 4%/var

Du results:

[root@centos192 var]# du-sh/var/
1.6g/var/

Both results are basically the same at this point.

(4) Simulate a process to open this large file, and then delete this large file

[root@centos192 var]# tail-f Myfile.iso &
[1] 23277
[root@centos192 var]# rm-f Myfile.iso

(5) At this point, compare the results of DU and DF

First confirm that there is a process holding the myfile.iso handle.

[Root@centos192 var]# lsof | grep Myfile.iso
Tail 23955 root 3r REG 8,1 1048576000 7999/var/myfile.iso (Deleted)

[root@centos192 var]# du-sh/var/
596m/var/
[root@centos192 var]# df-h/dev/sda1
File system capacity has been used available with percent mount point
/DEV/SDA1 49G 1.8G 44G 4%/var

As can be seen, DF results are unchanged, and du no longer counts deleted file Myfile.iso.

(6) Stop the simulation process (Kill-9 23955), and then compare du and DF results

First verify that no process holds the myfile.iso handle.

[Root@centos192 var]# lsof | grep Myfile.iso
[root@centos192 var]#

[root@centos192 var]# du-sh/var/; Df-h/dev/sda1
596m/var/
File system capacity has been used available with percent mount point
/DEV/SDA1 49G 776M 45G 2%/var

At this point, Myfile.iso has no process to occupy it, but also deleted from the disk, the partition's Super block information has changed, DF also shows normal.

4 places to pay attention to in the work

(1) When there is a large gap between Du and DF, consider whether there is an incomplete deletion of the file, by lsof the command, and then stopping the associated process ( This step requires considerable caution because this process is likely to be very important for application-starting processes, so the kill-9 ${process number Make sure that the process can be stopped directly before .

(2) You can use the method of emptying files instead of deleting files by: echo > Myfile.iso.

(3) For frequent deletion of the log files, in order to change the name, empty, delete the sequence of operations.

(4) In addition to RM, some of the commands will be indirectly deleted files, such as the gzip command will delete the original file, in order to avoid the problem of deletion, before compression to confirm that no process to open the file.