du and df show different results

Document Audience:	SPECTRUM
Document ID:	4083
Title:	ADMIN UFS: du and df show different results
Update Date:	Mon Mar 28 00:00:00 MST 2005
Products:	Solaris
Technical Areas:	Commands,  Filesystem

----------------------------------------------------------------------------------------------------------------------------------

Keyword(s):troubleshooting, error, failure, file, system, full, discrepancy Note: This document contains info previously available in SRDB 13165 (step 3 above)

Document Body:

The following Infodoc assumes a PATH variable that contains /usr/sbin and /usr/bin. For commands or files that normally exist outside of these common 
directories, full paths are specified.

Why "du" and "df" report different totals of used disk space?

SHORT ANSWER

There are 3 reasons why du and df can show different answers:

  1. Inconsistent fileystem requiring fsck(1m).
  2. Process with open file which does not exist in filesystem.
  3. Mount point directory contains data.

LONG ANSWER

Before going into detail for the 3 possibilities, it is important to recognize how du and df obtain their answers:

  . du "walks" the filesystem (like "find" command would),checking the size of each file in turn, and keeping track of the total.

  . df makes a system call to the filesystem itself and requests a number of details, one of which is the current disk space used.
    (it gets the info directly from the superblocks of the filesystem).

1. Inconsistent fileystem requiring fsck(1m).

   If the filesystem becomes corrupt/inconsistent for some reason, it is quite likely that du and df will differ.  What can be seen by a
   process looking at the filesystem (i.e. du), does not match up with the view the filesystem itself has (i.e. what will be returned to
   the querying df process).
   
   Corrupt/inconsistent filesystems should be repaired using fsck(1m).
   
2. Process with open file which does not exist in the filesystem directory structure.

   This scenario commonly occurs when some process keeps writing to a file
   (usually a logfile) and a sysadmin deletes the file in panic to prevent
   the filesystem from filling up.  But the offending process keeps running and the space is not freed (the process keeps the file open).

   The disk blocks associated with a file are actually deleted and made available for reuse when the last "reference" to the file is removed.
   When a Unix process opens a file, the reference count to that file is
   incremented.  Subsequently, if the file itself is removed from the 
   filesystem, the data blocks remain in use until the process closes the file, either explicitly with close(2), or implicitly when the 
   process dies.

   Under these conditions, du will be unable to "see" the file in the filesystem (it was rm'd from the dir. structure), and therefore will 
   not count its size, but df (in getting the answer from the filesystem itself) "knows" the file still exists.

   When the process closes the file (explicitly, or implicitly when the process either quits or is killed, or the machine is rebooted), the
   disk blocks will return to the freelist and du and df will agree. Actually it is the unmount and remount of the filesystem that fixes
   this problem.  But obviously if some process has an open file on the filesystem, it will be impossible to unmount the filesystem (device busy).
   
   See infodoc 17720 for additional info on the above scenario.
   
3. Directory mount point containing data.

   As filesystems are mounted on top of directories, if a directory
   mount point contains data, the du process will be unable to see this
   data (seeing only the mounted filesystem), but the underlying filesystem will still keep track of this data, consequently df will 
   report the extra disk space in use.

   Unmounting the filesystem will reveal the data.  However, if the mounted filesystem is being used by running processes it will not be possible
   to unmount it.  Either identify and kill the processes (fuser(1m), etc.), or reboot (possibly in single user mode) to check the mount point directory.