20

I have a Linux CentOS server, the OS+packages used around 5GB. Then, I transferred 97GB data from a Windows server to two folders on this Linux server, after calculated the disk usage, I see the total size of the two folders is larger than the disk used size.

Run du -sh on each folder, one use 50GB, the other one use 47GB

But run df -h, the used space is 96GB. (50GB + 47GB + 5GB) > 96GB

Is there any problem? Those two folders contain lots of files (1 million+). Thanks.

agc
  • 7,223
garconcn
  • 315
  • http://superuser.com/questions/235599/i-am-confused-with-the-output-of-command-du-in-linux http://superuser.com/questions/94217/ls-and-du-shows-very-different-size – Mikel Mar 19 '11 at 01:06
  • To be clear: are you running du and df on the copy on your Linux file system, or are you running them on a Windows/Samba mount point? – Mikel Mar 19 '11 at 01:13
  • I was running du an df on the Linux server. – garconcn Mar 21 '11 at 17:40
  • In my case it was due to large deleted file that were still open somehow. I checked with lsof|grep deleted which showed some very large files open by nginx, so I restarted service restart nginxand I had atail -f` process still open on that file in a tmux terminal, so I stopped that. see https://unix.stackexchange.com/questions/766326/why-does-du-xshc-report-only-35gb-usage-while-my-100gb-disk-is-showing-as-full/766327#766327 – rubo77 Jan 06 '24 at 22:34

2 Answers2

15

This page gives some insight on why they have different values, however it seems to suggest that your du size should be the smaller of the two.

df uses total allocated blocks, while du only looks at files themselves, excluding metadata such as inodes, which still require blocks on the disk. Additionally, if a file is deleted while an application has it opened, du will report it as free space but df does not until the application exits.

ceyko
  • 291
  • this explains why df claims the disk is full... when it's not. – xenoterracide Mar 19 '11 at 07:43
  • 3
    your comment is incorrect. if df says the disk is full, it is, at that point in time, full. files that have been deleted but are still held on to by running processes do consume space. that space cannot be used for other files. – Mat Mar 19 '11 at 09:02
  • 3
    df used space doesn't include the inode table. It includes data for files that don't have a name in any directory, like deleted files, special files like the ext4 journal, or files masked by another mounted file system. – Stéphane Chazelas Dec 15 '17 at 11:26
5

When du is larger than df, the usual reason is "sparse blocks": if a program doesn't actually write to a disk block but instead seeks past it, it gets a zero pointer in the inode's block allocation map and no actual disk space is reserved for it. If you later write to it, an actual disk block will be allocated and the map will be changed to point to the new block.

geekosaur
  • 32,047