Reasons for inconsistent usage of disk space displayed by DF and Du and troubleshooting

Check disk space usage in Linux. The most common ones are du and DF. However, there are still many differences between the two, and sometimes their output results are even very different.

1. How to remember these two Commands

Du-disk
Usage

DF-disk
Free

2. df and du working principle 2.1 du working principle the du command will call the fstat system one by one for statistical files to get the file size. Its data is obtained based on files, so it has great flexibility. It does not have to be targeted at a single partition and can be operated across multiple partitions. If there are many files in the target directory, the du speed will be very slow. 2.2 working principle of DF the statfs system call is used by the DF command to directly read the super block information of the partition to obtain the partition usage. Its data is based on partition metadata, so it can only target the entire partition. Because DF directly reads the super block, the running speed is not affected by the file size. 3. When Du and DF are inconsistent, the common inconsistency between DF and Du is the file deletion problem. After a file is deleted, it is invisible in the file system directory, so du will no longer count it. However, if a running process still holds the handle of the deleted file, the file will not be deleted from the disk, and the information in the partition super block will not be changed. In this way, DF will still count the deleted file. (1) usage of the current partition sda1

[Root @ centos192 testdu] # DF-H/dev/sda1 file system capacity in use available % mount point/dev/sda1 49G 776 M 45g 2%/var

(2) create a large 1 GB File

[Root @ centos192 var] # dd If =/dev/Zero of = myfile. iso bs = 1024 k count = 1000 records 1000 + 0 read records 1000 + 0 write 1048576000 bytes (1.0 GB) Copied, 24.0954 seconds, 43.5 MB/second

(3) dF result of partition sda1 usage:

[Root @ centos192 var] # DF-H/dev/sda1 file system capacity in use available % mount point/dev/sda1 49G 1.8g 44g 4%/var

Du result:

[root@centos192 var]# du -sh /var/1.6G/var/

The results are basically the same.

(4) simulate a process to open the large file and then delete the large file.

[root@centos192 var]# tail -f myfile.iso &[1] 23277[root@centos192 var]# rm -f myfile.iso 

(5) At this time, compare the results of DU and DF to confirm that a process holds the myfile. ISO handle.

[root@centos192 var]# lsof | grep myfile.isotail      23955      root    3r      REG                8,1 1048576000       7999 /var/myfile.iso (deleted)

[Root @ centos192 var] # Du-SH/var/596 M/var/[root @ centos192 var] # DF-H/dev/sda1 file system capacity in use % mount point/dev/sda1 49G 1.8g 44g 4%/var

It can be seen that the DF result has not changed, while du no longer counts the deleted file myfile. ISO.
(6) Stop the simulated process, and compare the results of DU and DF to confirm that no process holds the myfile. ISO handle.

[root@centos192 var]# lsof | grep myfile.iso[root@centos192 var]# 

[Root @ centos192 var] # Du-SH/var /; DF-H/dev/sda1596m/var/file system capacity used available % mount point/dev/sda1 49G 776 M 45g 2%/var

At this time, no process occupies myfile. ISO, and the super block information of the partition has been changed, and DF is displayed as normal.
4. Notes during work (1) when there is a big gap between du and DF, consider whether the deletion of files is incomplete by using the lsof command, then stop the process. (2) You can use the clear file method instead of deleting the file by echo> myfile. ISO. (3) log files with frequent deletion problems are operated in the order of renaming, clearing, and deleting. (4) In addition to RM, some commands will indirectly delete files. For example, after the gzip command is completed, the original files will be deleted. To avoid deletion problems, make sure that no process opens the file before compression.