df reports false size

[Andreas Dilger]

On Jan 30, 2006  19:38 +0100, Felix E. Klee wrote:
> On a customer's machine running SuSE 9.2, the size of the occupied space on  
> the harddisk is reported incorrectly by "df -h".
> 
> # df -h /
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/sda1             7.6G  7.0G  216M  98% /
> # du -shx /
> 4.2G    /
> # find / -xdev | wc -l
> 161021

> # tune2fs -l /dev/sda1
> tune2fs 1.35 (28-Feb-2004)
> Inode count:              1005888
> Block count:              2010125
> Reserved block count:     100506
> Free blocks:              155746
> Free inodes:              744793
> First orphan inode:       357173

The "find | wc -l" definitely does not agree with the superblock info.
That reports (1005888 - 744793 = 261095) in use inodes, not 161021.
If those numbers agreed, I'd suspect some space leakage (though not
after an e2fsck run).  With 2.6 kernels the ext3 superblock info does
not get updated on disk, except at shutdown (though it would be nice to
have this done at, say, statfs time).

There are no EAs consuming blocks (this would be 4kB per file, so 1GB
in total for 250k files).

> Later we also tried out the following commands - apparently sparse files or 
> unlinked files are not to blame:
> 
> # lsof -s | grep deleted
> vmware-vm 15452    arzt   48u      REG        8,1   11948032     
> 357177 /tmp/ram0 (deleted)
> isam       6354   david    0r      REG        8,1         55     
> 357173 /tmp/sh-thd-1138650835 (deleted)

This is also the file shown in the orphan inode list, so at least it
is consistent.  I also wouldn't expect files to be orphaned after e2fsck.

The other thing you can do is run "dumpe2fs /dev/sda1" to see what the
block group descriptors report for free blocks/inodes.  You'd need some
scripting to add this up, but fairly easy.

Cheers, Andreas
--
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.