I have strange issue, df shows rootfs is 100% full but du shows it's 25% used. So I check on the unlinked files from the rootfs using lsof +aL1 / and it does not show me any deleted/unlinked files from rootfs. I tried find /proc/*/fd -ls | grep '(deleted)' too and it does not show any unlinked file from rootfs!
Inode usage is only at 9%
As suggested in the comments, a bind mount might hide files and directories from the du command. But there might be something else as well...
The following might be revealing:
% strace -e statfs df /
statfs("/", {f_type="EXT2_SUPER_MAGIC", f_bsize=4096, f_blocks=6288727, f_bfree=4705740, f_bavail=4380531, f_files=1605632, f_ffree=1412254, f_fsid={1878967121, -50608953}, f_namelen=255, f_frsize=4096}) = 0
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda2 25154908 6331948 17522124 27% /
+++ exited with 0 +++
Note that there is a difference between f_bfree and f_bavail. From man statfs:
fsblkcnt_t f_bfree; /* Free blocks in filesystem */
fsblkcnt_t f_bavail; /* Free blocks available to
unprivileged user */
The Used column is based on a calculation: it is total block count - free block count.
df -landdu -s /? – David King Jan 06 '16 at 15:28