strange behaviour of df command

[Dag Wieers]

On Tue, 10 Oct 2006, Atul Tyagi wrote:

> I am facing a little problem. I guess its more of a conceptual problem
> rather than a OS issue.
> 
> One of my software raid partiton /dev/md4 is about 30 GB. I had put a file
> of about 18GB in that jus for few mins and then deleted that. Now even after
> about 6 hrs. My RHEL4 system gives me weird output. following are the
> outputs that might help you understand.
> 
> df -h
> ===
> 
> [root at pingu ~]# df -h
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/md0              5.0G  2.7G  2.1G  56% /
> /dev/md1               99M   17M   78M  18% /boot
> none                 1014M     0 1014M   0% /dev/shm
> /dev/md2              5.0G  190M  4.5G   4% /var
> /dev/md4               30G   22G  5.9G  79% /usr/local/test
> 
> du -hs
> =====
> [root at pingu ~]# du -hs /usr/local/test
> 2.7G    /usr/local/test
> 
> Can some one please clear my doubt and explain why there is a such a hugh
> difference in both the commands. Disk usage shown by df -h is 22G where as
> du shows 2.7G.

Is it possible that something still has this 18GB file open ?

It is not unsual that when removing a file, the diskspace is not freed 
because something is still using the file. Either has it still open, or in 
case of a loop-mount, has it still mounted.

If this is the case, the difference can be explained as follows: df is 
giving the information stored in the filesystem, du is giving the 
information deduced from traversing the filesystem and collecting the 
metadata.

If you delete a file that is still in use, the inode is still allocated 
(since something is using it), but the directory entry (what we humans 
work with) has been deleted. Since du is traversing the directories, it 
finds no reference and doesn't count it as being 'used'.

One way to make sure is by using lsof (ls of open files). Something like:

	lsof | grep <filename>

lsof is great as it both displays the files being in use and that are 
deleted. (As it checks whether the reference in the filesystems exists or 
not).

If you then stop the program that is using the file, the diskspace that 
was allocated will be freed instantly.

Let me know whether this was going on or not.

PS A reboot will help as well, but then you don't know what was going on :)

Kind regards,
--   dag wieers,  dag at wieers.com,  http://dag.wieers.com/   --
[all I want is a warm bed and a kind word and unlimited power]