Re: du and df not in sync?

[Erik Steffl <steffl@bigfoot.com>]

Miquel van Smoorenburg wrote:
> 
> In article <[🔎] 3A748280.54452746@bigfoot.com>,
> Erik Steffl  <steffl@bigfoot.com> wrote:
> >  the du and df report quite a different amounts of data on my root
> >partition:
> >jojda:/home/erik# du -s -h -x /
> >110M    /
> >jojda:/home/erik# df -h
> >Filesystem            Size  Used Avail Use% Mounted on
> >/dev/hda4             1.0G  649M  331M  67% /
> 
> That in most cases means some process has a (log)file open which
> has been deleted. Because it's still open, it still takes space,
> but there's no directory entry for it anymore. So du -s -h -x /
> won't find it and can't include its size in the total.
> 
> "df" however simply asks the filesystem for used/free info, and
> that does include the space used by those "phantom" files.
> 
> If you kill the process that has that (log)file open, the space
> it used will be released. Ofcourse a reboot will do the same thing.
> 
> You can find a list of those files and the processes keeping
> then open by doing (as root):
> 
> ls -l /proc/*/fd | fgrep '(deleted)'
> 
> If you see the same after a reboot, your filesystem is probably
> a bit broken. The easiest way to force a file system check is
> then to do "sync; sleep 3; sync; sleep 1; reboot -f". Yes it's
> what we dutch people call "the blunt axe approach" but it works ;)
> 
> Mike.

  thanks, that must have been it, kdeinit had quite a few (deleted)
files opened, some of them of scary size (5GB, but I guess that was not
a real size since the partition is only 1GB), once I rebooted (different
reason, mouse fun stuff) the df and du report approximately same sizes.
I have found out that lsof | grep '(deleted)' works even better than
your suggested command since it lists the names of the programs that
have these files open and size etc...

	erik