On Sun, Dec 31, 2006 at 01:13:30AM +0200, ccostin wrote:
> On a partition mounted as /tmp on /dev/hda2 df report
>
> df -h | grep -E "Size|hda2"
> Filesystem Size Used Avail Use% Mounted on
> /dev/hda2 479M 454M 0 100% /tmp
>
> and total space used by /tmp directory is
>
> du -sh /tmp/
> 1.4M /tmp/
>
> Why this differences between used space reported df and du appear ?
>
The way that du measure disk utilization is to check for all existing
files and directories and see how many disk blocks they use and add them
all up. OTOH, df checks with the filesystem to see how many blocks are
not used. You are asking why the sum of blocks used by existing files
and directories and the unused blocks is not the whole of the blocks in
the filesystem. The reason is that there are nonexistent files.
What that means is that a program needs a temporary file and so it calls
a function like tmpfile, which creates a temporary file. In order to
minimize the vulnerability of information leaking from a temporary file,
some programs call unlink() right after the file is created. As long as
the program retains the open file descriptor, the file can be read from
and written to, but no one else can access it, since it is not
addressable via the filesystem. Once the program closes, the file
descriptor is reclaimed by the OS and all the blocks are again marked as
free.
I believe that qemu does this as I often see the exact same thing you
are talking about after laeving qemu running for long periods of time.