Causes of filesystem usage discrepancies
Jump to navigation
Jump to search
Q: Why do tools such as du and df report different amounts of used space?
A: Possible causes of discrepancies, listed in rough order of probability:
- Files have been deleted but are still opened by some process
- Using du without the --one-file-system option, so you end up including the contents of subdirectories that are mount points
- Files have been removed or reduced in size and the super block has not been updated: you can force an update using the sync command and examine what files are being modified using the LiSt Open Files utility
- Lost blocks on a damaged file system: use fsck to find and repair the damage
- Files hidden to the reporting utilities; e.g.: files in a directory that has been covered by a mount-point: try unmounting everything but the filesystem in question and examining the mount stubs
- Journals on a journaling filesystem such as Ext3 or ReiserFS: the standard utilities for each filesystem should include a tool that displays journal information; e.g.: `debugreiserfs <device>` reports the number of blocks occupied by a ReiserFS journal on <device>
- Files hidden for nefarious purposes such as by a Rootkit