"du -sx" and "dh" differs dramatically

"du -sx" and "dh" differs dramatically

Post by peter pils » Fri, 19 Apr 2002 19:27:23



just dont get this into my brain:

If I check the used space of my root-partition with  "du" and then check it
with "df" the difference is by factor 10 !!

# df -h  | grep hda8
/dev/hda8             996M  708M  289M  71% /

# du -shx /
78M     /

so df tells me that / has already 708M used and du tells me that I've used
78MB.  Thats not a small difference ;)

whats my problem here ? (sure its my problem and not the problem of my
machine. I'm obviuosly missing something here ...)

thnx,
peter

--
peter pilsl

http://www.goldfisch.at

 
 
 

"du -sx" and "dh" differs dramatically

Post by dav.. » Fri, 19 Apr 2002 19:50:25



> If I check the used space of my root-partition with  "du" and then check it
> with "df" the difference is by factor 10 !!

Are you sure you are looking in the right /dev/hd when you use
df -h ?

On my machine I have these results:

# df -h | grep /dev/hda5
/dev/hda5              99M   48M   45M  51% /

# du -shx /
48M     /

As you can see. They are perfectly coherent...

Davide

 
 
 

"du -sx" and "dh" differs dramatically

Post by Floyd Davidso » Fri, 19 Apr 2002 20:12:44



>just dont get this into my brain:

>If I check the used space of my root-partition with  "du" and then check it
>with "df" the difference is by factor 10 !!

># df -h  | grep hda8

Lets see the rest of what df prints out.

You may have mounted a filesystem on top of a directory with
files in it, which would cause the discrepancy you are seeing.

You also may have a corrupted filesystem too.

I would suggest taking the system down to single user,
unmounting all filesystems except the root partition,
and doing this again.  If you still see a difference,
remount the root filesystem readonly and run fsck on
it.

  mount -o remount,ro /
  /sbin/e2fsck -f /dev/hda8

Please post whatever it is that you find.

>/dev/hda8             996M  708M  289M  71% /

># du -shx /
>78M     /

>so df tells me that / has already 708M used and du tells me that I've used
>78MB.  Thats not a small difference ;)

>whats my problem here ? (sure its my problem and not the problem of my
>machine. I'm obviuosly missing something here ...)

>thnx,
>peter

>--
>peter pilsl

>http://www.goldfisch.at

--
Floyd L. Davidson         <http://www.ptialaska.net/~floyd>

 
 
 

"du -sx" and "dh" differs dramatically

Post by Steve Holdowa » Fri, 19 Apr 2002 23:58:26


All together now...

Open files, open files, open files...!

df takes into account all used blocks, but du summarises all files on
the partition. If a file ( ? log file for example )  is open, the it
won't get counted.

So, the worry is then du is _greater_ than df.

HTH

Steve



Quote:

>just dont get this into my brain:

>If I check the used space of my root-partition with  "du" and then check it
>with "df" the difference is by factor 10 !!

># df -h  | grep hda8
>/dev/hda8             996M  708M  289M  71% /

># du -shx /
>78M     /

>so df tells me that / has already 708M used and du tells me that I've used
>78MB.  Thats not a small difference ;)

>whats my problem here ? (sure its my problem and not the problem of my
>machine. I'm obviuosly missing something here ...)

>thnx,
>peter

 
 
 

"du -sx" and "dh" differs dramatically

Post by peter pils » Sat, 20 Apr 2002 00:13:39



> Lets see the rest of what df prints out.

> You may have mounted a filesystem on top of a directory with
> files in it, which would cause the discrepancy you are seeing.

> You also may have a corrupted filesystem too.

> I would suggest taking the system down to single user,
> unmounting all filesystems except the root partition,
> and doing this again.  If you still see a difference,
> remount the root filesystem readonly and run fsck on
> it.

>   mount -o remount,ro /
>   /sbin/e2fsck -f /dev/hda8

> Please post whatever it is that you find.

thnx a lot.
Should have been more detailed in my first posting.
When I examined the problem I did it when all partitions where mounted
read-only to avoid troubles with locked files and that kind.
I also did a fschk with no noticeable errors.

The filesystem is reiserfs (another thing I did not mention ...) and after
I read your posting I decided that there need to be some troubles with the
filesystem and decided to rebuild the whole reiser-tree on the reiserfs and
this turned out to bring out the truth:

now, after the rebuild even "du" shows the correct size. The missing 600MB
are now in a directory named "lost+found" ;)

by now all is running fine but I've to check the whole system to check
which files were affected here.

I even didnt know that rebuilding the tree of a reiserfs can put files to
lost+found. So maybe the files were in before and just the directory was
broken and fixed now. Also the files in lost+found have older dates.  But
dont know how reiserfs puts the files in there.

peter

--
peter pilsl

http://www.goldfisch.at

 
 
 

"du -sx" and "dh" differs dramatically

Post by Villy Kru » Sat, 20 Apr 2002 16:17:43


On Thu, 18 Apr 2002 17:13:39 +0200,

Quote:

>I even didnt know that rebuilding the tree of a reiserfs can put files to
>lost+found. So maybe the files were in before and just the directory was
>broken and fixed now. Also the files in lost+found have older dates.  But
>dont know how reiserfs puts the files in there.

One way that could happen (on any unix file system) is that a file is
deleted while it is open, and the system crashes or gets a power failure
before the file is closed.  The file will then still exist in the file
system, but have no name associated with it.  When running fsck these
files will be found at given a name in lost+found, so you have a chance
to delete it properly or restore it with its original name.

Some programs will routinely create a temporary file, and immediately
remove the name after opening the file.  The file will then exist on
disk sithout name until it is closed and then removed.  Deleting a
huge log file while it is still open will have the same effect.

Villy