欢迎加入IT云增值在线QQ交流群:342584734
分类:
2005-07-15 22:52:26
Document Audience: | SPECTRUM | |
Document ID: | 4083 | |
Title: | ADMIN UFS: du and df show different results | |
Update Date: | Mon Mar 28 00:00:00 MST 2005 | |
Products: | Solaris | |
Technical Areas: | Commands, Filesystem |
----------------------------------------------------------------------------------------------------------------------------------
Keyword(s):troubleshooting, error, failure, file, system, full, discrepancy Note: This document contains info previously available in SRDB 13165 (step 3 above)
The following Infodoc assumes a PATH variable that contains /usr/sbin and /usr/bin. For commands or files that normally exist outside of these common directories, full paths are specified. Why "du" and "df" report different totals of used disk space? SHORT ANSWER There are 3 reasons why du and df can show different answers: 1. Inconsistent fileystem requiring fsck(1m). 2. Process with open file which does not exist in filesystem. 3. Mount point directory contains data. LONG ANSWER Before going into detail for the 3 possibilities, it is important to recognize how du and df obtain their answers: . du "walks" the filesystem (like "find" command would),checking the size of each file in turn, and keeping track of the total. . df makes a system call to the filesystem itself and requests a number of details, one of which is the current disk space used. (it gets the info directly from the superblocks of the filesystem). 1. Inconsistent fileystem requiring fsck(1m). If the filesystem becomes corrupt/inconsistent for some reason, it is quite likely that du and df will differ. What can be seen by a process looking at the filesystem (i.e. du), does not match up with the view the filesystem itself has (i.e. what will be returned to the querying df process). Corrupt/inconsistent filesystems should be repaired using fsck(1m). 2. Process with open file which does not exist in the filesystem directory structure. This scenario commonly occurs when some process keeps writing to a file (usually a logfile) and a sysadmin deletes the file in panic to prevent the filesystem from filling up. But the offending process keeps running and the space is not freed (the process keeps the file open). The disk blocks associated with a file are actually deleted and made available for reuse when the last "reference" to the file is removed. When a Unix process opens a file, the reference count to that file is incremented. Subsequently, if the file itself is removed from the filesystem, the data blocks remain in use until the process closes the file, either explicitly with close(2), or implicitly when the process dies. Under these conditions, du will be unable to "see" the file in the filesystem (it was rm'd from the dir. structure), and therefore will not count its size, but df (in getting the answer from the filesystem itself) "knows" the file still exists. When the process closes the file (explicitly, or implicitly when the process either quits or is killed, or the machine is rebooted), the disk blocks will return to the freelist and du and df will agree. Actually it is the unmount and remount of the filesystem that fixes this problem. But obviously if some process has an open file on the filesystem, it will be impossible to unmount the filesystem (device busy). See infodoc 17720 for additional info on the above scenario. 3. Directory mount point containing data. As filesystems are mounted on top of directories, if a directory mount point contains data, the du process will be unable to see this data (seeing only the mounted filesystem), but the underlying filesystem will still keep track of this data, consequently df will report the extra disk space in use. Unmounting the filesystem will reveal the data. However, if the mounted filesystem is being used by running processes it will not be possible to unmount it. Either identify and kill the processes (fuser(1m), etc.), or reboot (possibly in single user mode) to check the mount point directory.