Unix - df output is /var 98% but just 374mb used in du output

Question

Here is my df -g output:

df -g /var
Filesystem    GB blocks      Free %Used    Iused %Iused Mounted on
/dev/hd9var        3.50      0.10   98%     6376     18% /var

But if a enter in the mount point and issue du command, I get the following output

ux-zzz02:/var>du -sm .
374.38  .
ux-zzz02:/var>

How can this happen? I have only 374mb being used but df command says it's used 98% of 3.50gb

Sometime this happens if du does not have permission to enter a directory. — ctrl-alt-delor, Feb 02 '20 at 08:32
@DaniloNeto per the note that mattdm linked to, did you delete any log files recently? Those may have been held open by existing processes. — Jeff Schaller, Feb 03 '20 at 12:12

score 1 · Answer 1 · edited Feb 04 '20 at 10:22

1

"lsof" is all that you need....

lsof | grep -i delete

The output will show you if some file(s) still in use have been deleted.

Regards

edited Feb 04 '20 at 10:22

Romeo Ninov

17,484

answered Feb 02 '20 at 09:03

Alberto

505

Notice that the user is on AIX. There is by default no lsof command on AIX, AFAIK. – Kusalananda Feb 02 '20 at 10:11
1

Indeed, it's not provided directly any more; it used to be on the AIX Toolbox for Linux Applications. Per this forum post, it's been removed. – Jeff Schaller Feb 03 '20 at 12:09
3

As an alternative to lsof, use fuser -dV /var which also shows deleted files with open filehandles for a given mountpoint/filesystem. – doktor5000 Feb 03 '20 at 14:50
lsof can be compiled from source, and OP had root access, so this answer might be usable. – Lorinczy Zsigmond Feb 04 '20 at 08:18

YoMismo · Answer 2 · 2020-04-01T14:24:13.667

Do you have mount points inside /var?

When you mount something on a directory it does not matter if the directory is empty or not, it just mounts what you told it to mount. According to this you may have mounted something on a directory which was not empty and have a lot of files or just a few files that occupy a lot of space. Using du won't take into account those files since it will only see the files on the mounted fs, and that may be the "unjustified" discrepancy between those two commands.

Try unmounting those directories and checking if you have files there.

Unix - df output is /var 98% but just 374mb used in du output

2 Answers2