Reasons for inconsistent usage of disk space displayed by df and du and troubleshooting

Check disk space usage in Linux. The most common ones are du and df. However, there are still many differences between the two, and sometimes their output results are even very different.

Linux Command cd

Cat for Linux commands

Linux Command alias/unalias

Linux Command Parsing: su root and su-root

Interactive input of Linux commands read

1. How to remember these two Commands

Du-Disk Usage

Df-Disk Free

2. Working Principle of df and du

Working principle of 2.1 du

The du command calls the fstat system one by one for statistics files to get the file size. Its data is obtained based on files, so it has great flexibility. It does not have to be targeted at a single partition and can be operated across multiple partitions. If there are many files in the target directory, the du speed will be very slow.

2.2 how df works

The statfs System Call used by the df command directly reads the super block information of the partition to obtain the partition usage. Its data is based on partition metadata, so it can only target the entire partition. Because df directly reads the super block, the running speed is not affected by the file size.

3 Simulation of inconsistency between du and df

The common inconsistency between df and du is the problem of file deletion. After a file is deleted, it is invisible in the file system directory, so du will no longer count it. However, if a running process still holds the handle of the deleted file, the file will not be deleted from the disk, and the information in the partition super block will not be changed. In this way, df will still count the deleted file.

(1) usage of the current partition sda1

[Root @ CentOS192 testdu] # df-h/dev/sda1
File System capacity in use available % mount point
/Dev/sda1 49G 776 M 45G 2%/var

(2) create a large 1 GB File

[Root @ centos192 var] # dd if =/dev/zero of = myfile. iso bs = 1024 k count = 1000
Recorded 1000 + 0 reads
Records 1000 + 0 writes
1048576000 bytes (1.0 GB) Copied, 24.0954 seconds, 43.5 MB/second

(3) Partition sda1 usage at this time

Df result:

[Root @ centos192 var] # df-h/dev/sda1
File System <span style = "white-space: pre;"> </span> & nbsp; capacity & nbsp; used & nbsp; available in use % mount point
/Dev/sda1 & nbsp; 49G & nbsp; 1.8G & nbsp; 44G & nbsp; 4%/var

Du result:

[Root @ centos192 var] # du-sh/var/
1.6G/var/

The results are basically the same.

(4) simulate a process to open the large file and then delete the large file.

[Root @ centos192 var] # tail-f myfile. iso &
[1] 23277
[Root @ centos192 var] # rm-f myfile. iso

(5) then compare the results of du and df.
 
First, check that a process holds the myfile. iso handle.

[Root @ centos192 var] # lsof | grep myfile. iso
Tail 23955 root 3r REG 1048576000 7999/var/myfile. iso (deleted)

[Root @ centos192 var] # du-sh/var/
596 M/var/
[Root @ centos192 var] # df-h/dev/sda1
File System capacity in use available % mount point
/Dev/sda1 49G 1.8G 44G 4%/var

It can be seen that the df result has not changed, while du no longer counts the deleted file myfile. iso.

(6) Stop the simulated process and compare the results of du and df.

First, make sure that no process holds the myfile. iso handle.

[Root @ centos192 var] # lsof | grep myfile. iso
[Root @ centos192 var] #

[Root @ centos192 var] # du-sh/var/; df-h/dev/sda1
596 M/var/
File System capacity in use available % mount point
/Dev/sda1 49G 776 M 45G 2%/var

At this time, no process occupies myfile. iso, and the super block information of the partition has been changed, and df is displayed as normal.

4. Notes during work

(1) When there is a big gap between du and df, consider whether the deletion of files is incomplete by running the lsof command and then stop the related process.

(2) You can use the clear file method instead of deleting the file by echo> myfile. iso.

(3) log files with frequent deletion problems are operated in the order of renaming, clearing, and deleting.

(4) In addition to rm, some commands will indirectly delete files. For example, after the gzip command is completed, the original files will be deleted. To avoid deletion problems, make sure that no process opens the file before compression.

For more details, please continue to read the highlights on the next page:

1 2 Next Page