df show bigger disk usage than du on Server

[eUKShane]

Issue:

Why does df show bigger disk usage than du?

Resolution:

There are some instances where df would output a bigger disk usage than du. The most common instance is when a process has opened a huge file and that same file is deleted with rm. Technically, the file still exists because a process still has an open file descriptor associated with that file. An example is presented below.

First, a 200Mb file called bigfile is created and is opened using the vi editor:

[root@localhost ~]# ls -lh bigfile
-rw-r--r-- 1 root root 200M Dec 22 14:53 bigfile
[root@localhost ~]# lsof|grep bigfile
vi 23824 root 3r REG 3,2 209715200 2052534 /root/bigfile
vi 23824 root 4u REG 3,2 4096 2052542 /root/.bigfile.swp

At this point, both df and du would have the same output:

[root@localhost ~]# df -h /
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 19G 8.8G 8.4G 51% /
[root@localhost ~]# du -sh /
8.8G /

Now the discrepancy in output shows once bigfile is deleted:

[root@localhost ~]# rm -f bigfile
[root@localhost ~]# df -h /
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 19G 8.8G 8.4G 51% /
[root@localhost ~]# du -sh /
8.6G /

Killing the vi process that has opened bigfile resolves the discrepancy:

[root@localhost ~]# kill 23824
[root@localhost ~]# df -h /
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 19G 8.6G 8.6G 50% /
[root@localhost ~]# du -sh
8.6G /

------------------------
Best Regards,
eUKShane :P
http://www.eukhost.com