Analyzing disk usage: inconsistent results from du, df

overbored · 11-21-2006, 05:28 PM

on my /, 'df' and 'du' are reporting very different numbers:

Code:

$ df -h /
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2              20G   19G  171M 100% /
$ sudo du -shx /
11G     /

i'd understand if there was a difference of <1GB due to many small files, but where is half my entire disk going?

i also checked if there were large open-but-deleted files, but i'm not entirely sure how to do this, since 'lsof -ns | grep DEL' doesn't actually report any file sizes:

Code:

$ lsof -ns | head -1
COMMAND     PID      USER   FD      TYPE     DEVICE     SIZE       NODE NAME
$ lsof -ns | grep DEL
bash       2583      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash       2583      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
evince     3056      yang  DEL       REG        0,8           793903159 /SYSV00000000
evince     3056      yang  DEL       REG        0,8           793870384 /SYSV00000000
evince     3056      yang  DEL       REG        8,2              428322 /tmp/FxZLFp
evince     3056      yang  DEL       REG        8,2              428321 /tmp/ADsRWz
evince     3056      yang  DEL       REG        8,2              428319 /tmp/giR2hK
evince     3056      yang  DEL       REG        8,2              428318 /tmp/2sJrIU
evince     3056      yang  DEL       REG        8,2              428316 /tmp/qD45c5
evince     3056      yang  DEL       REG        8,2              428312 /tmp/Tq0yLf
evince     3056      yang  DEL       REG        8,2              428300 /tmp/yKLrf5
evince     3056      yang  DEL       REG        8,2              428287 /tmp/C5wpxd
evince     3056      yang  DEL       REG        8,2              428274 /tmp/VJDq3l
evince     3056      yang  DEL       REG        8,2              428267 /tmp/cRgPzu
evince     3056      yang  DEL       REG        8,2              428266 /tmp/2ZsQ7D
evince     3056      yang  DEL       REG        8,2              428265 /tmp/qZA8FN
evince     3056      yang  DEL       REG        8,2              428261 /tmp/WvLp96
evince     3056      yang  DEL       REG        8,2              428258 /tmp/W7qapi
evince     3056      yang  DEL       REG        8,2              428255 /tmp/LkguMt
evince     3056      yang  DEL       REG        8,2              428253 /tmp/sgceaF
evince     3056      yang  DEL       REG        8,2              428252 /tmp/fcRcyQ
evince     3056      yang  DEL       REG        8,2              428251 /tmp/CYCPW1
evince     3056      yang  DEL       REG        8,2              428250 /tmp/IIy2Te
evince     3056      yang  DEL       REG        8,2              428249 /tmp/Y6RDRr
evince     3056      yang  DEL       REG        8,2              428263 /tmp/2uKGpX
evince     3056      yang  DEL       REG        8,2              428248 /tmp/MDlR2a
evince     3056      yang  DEL       REG        8,2              428246 /tmp/qFVIfU
evince     3056      yang  DEL       REG        8,2              428245 /tmp/SM3NAD
evince     3056      yang  DEL       REG        8,2              428244 /tmp/PFGs3m
evince     3056      yang  DEL       REG        8,2              428243 /tmp/FlfZx6
evince     3056      yang  DEL       REG        8,2              428236 /tmp/VbXT3P
evince     3056      yang  DEL       REG        8,2              428241 /tmp/Qas0Az
bash       3220      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
gnome-ses  4571      yang  DEL       REG        0,8           563019781 /SYSV00000000
metacity   4647      yang  DEL       REG        0,8           563380251 /SYSV00000000
metacity   4647      yang  DEL       REG        0,8           563314713 /SYSV00000000
metacity   4647      yang  DEL       REG        0,8           563281941 /SYSV00000000
gnome-pan  4653      yang  DEL       REG        0,8           563052554 /SYSV00000000
nautilus   4657      yang  DEL       REG        0,8           563150861 /SYSV00000000
nautilus   4657      yang  DEL       REG        0,8           563183630 /SYSV00000000
notify-da  4666      yang  DEL       REG        0,8           563085323 /SYSV00000000
pam-panel  4676      yang  DEL       REG        0,8           792723535 /SYSV00000000
wnck-appl  4689      yang  DEL       REG        0,8           563445797 /SYSV00000000
wnck-appl  4689      yang  DEL       REG        0,8           563413020 /SYSV00000000
wnck-appl  4689      yang  DEL       REG        0,8           563118092 /SYSV00000000
mixer_app  4705      yang  DEL       REG        0,8           563216399 /SYSV00000000
gnome-ter  4734      yang  DEL       REG        0,8           563249170 /SYSV00000000
firefox-b  4774      yang  DEL       REG        0,8           563478575 /SYSV00000000
firefox-b  4774      yang  DEL       REG        0,8           563347482 /SYSV00000000
firefox-b  4774      yang  DEL       REG        0,8           563544118 /SYSV00000000
bash       4993      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash       4993      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash       5173      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
artsd      5296      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
artsd      5296      yang  DEL       REG        8,2              560969 /usr/lib/libartsgslplayobject.so.0.0.0;454b24fd
artsd      5296      yang  DEL       REG        8,2              560985 /usr/lib/libvorbisfile.so.3.1.1.#prelink#.6WE0ky
artsd      5296      yang  DEL       REG        8,2              560965 /usr/lib/libartsbuilder.so.0.0.0.#prelink#.eDNW4D
artsd      5296      yang  DEL       REG        8,2              560996 /usr/lib/libsoundserver_idl.so.1.0.0;454b24fd
artsd      5296      yang  DEL       REG        8,2              559859 /usr/lib/libartsflow.so.1.0.0.#prelink#.3GMPCG
bash       7614      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash       7614      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash      11640      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash      11640      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash      12135      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash      12135      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash      13085      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash      13085      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash      13351      yang  DEL       REG        8,2              489666 /lib/libtermcap.so.2.0.8.#prelink#.sY3pmZ
bash      13351      yang  DEL       REG        8,2              558470 /usr/lib/locale/locale-archive
bash      15312      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
ssh       16051      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
bash      16059      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
artsd     22746      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2
artsd     22746      yang  DEL       REG        8,2              560969 /usr/lib/libartsgslplayobject.so.0.0.0;454b24fd
artsd     22746      yang  DEL       REG        8,2              560996 /usr/lib/libsoundserver_idl.so.1.0.0;454b24fd
bash      32624      yang  DEL       REG        8,2              489841 /lib/libnss_files-2.4.so.#prelink#.2lcoI2

matthewg42 · 11-21-2006, 05:51 PM

My first thought was deleted but open... but you ran lsof. Hmm. You ran it as root?

overbored · 11-30-2006, 12:26 AM

Quote:

Originally Posted by matthewg42

My first thought was deleted but open... but you ran lsof. Hmm. You ran it as root?

No. I re-ran it as root, but still don't see any file sizes being reported (those numbers are just node numbers). The paste is at http://paste.lisp.org/display/30985.

overbored · 12-01-2006, 09:23 PM

It was indeed all due to open files. A reboot later, df shows usage down to 52%. Still would like to know how to get lsof (or anything) to report file sizes on open files, though.