Why Do df and du Commands Show Different Disk Usage?

Symptom

When you run df and du respectively to check disk usage, different results are returned.

As shown in the following figure, the disk usage queried by running df -h is greater than that queried by running du -sh.

Possible Cause

Generally, the disk space is released after a file is deleted. However, there are exceptions, for example, the file you deleted is locked or there is another process that keeps writing data to the file.

A file is stored in the Linux file system in two parts: data and pointer. The pointer is stored in the meta-data and data in the disk. After data is deleted, the pointer is cleared from meta-data. After the pointer is cleared, the disk space occupied by the data can be released, and new content can be written. If the disk space is not released after a file is deleted, it may be that the process keeps writing data into the file. As a result, the pointer is not cleared because the process is locked, so the system kernel considers that the file is not really deleted because the pointer is not deleted. The df command output indicates that the disk space is not released.

After a file is deleted, it is unavailable in the file system directory, so the du command does not collect it. However, if a running process occupies the handle of the deleted file, the file is not really deleted from the disk, and the information in the partition superblock is not changed. In this way, the df command still collects the deleted file.

Solution

1. Run the following command to switch to the /opt directory:

   cd /opt

2. Run the following command to check all the files that have been deleted but are still occupied by processes:

   lsof | grep deleted

   

   The command output shows that the /var/log/docker/mongdb/log/mongdb log file occupies 190 GB of memory. The deleted status indicates that it has been deleted, but the process keeps writing data to the file, so the disk space is not released.

3. Run the following command to clear the file:

   echo >"/var/log/docker/mongdb/log/mongdb"

   In this way, the disk space can be released and the process can continue to write logs to files.