up vote 1 down vote favorite
share [g+] share [fb] 
# df -h /
Filesystem            Size  Used Avail Use% Mounted on
rootfs                9.9G  7.2G  2.2G  77% /

# du -hx --max-depth=0 /
3.2G    /

As you can see, df says 7.2GB is used, but du can only find 3.2GB of it. The server has been rebooted since I noticed this, so it's not a deleted file. Additionally, lsof doesn't show me anything interesting. What else could it be?

link|improve this question
1  
Have you tried a fsck? – Zoredache Aug 10 '11 at 21:50
Is your filesystem pathological in some way? E.g., many symlinks, many small files, many bad blocks? Assuming the fs type is ext[23] the output of e2freefrag and dumpe2fs may be helpful. – Mark Wagner Aug 10 '11 at 23:21
feedback

3 Answers

up vote 4 down vote

Since you're using the -x option, I assume you have other filesystems mounted? It could be that you have another partition mounted on top of a directory that wasn't empty.

link|improve this answer
feedback
up vote 3 down vote

There could be a couple of problems: (1) a process has a large file or number of files open that have been deleted, or (2) you might have some type of filesystem problem remedied by an fsck of the drive. However, this can only be done when the drive is not mounted. Several Linux provide a method of FULL fsck of the root file at boot time by:

 touch /forcefsck

and then rebooting. I know this exists in SuSE and RedHat varients.

link|improve this answer
He did mention he has rebooted recently, which should rule out the open file issue. – Zoredache Aug 10 '11 at 22:20
feedback
up vote 2 down vote

Make sure all folders "behind" your mountpoints are empty. Out of experience i'd say most probably you hide some data behind a mountpoint.

you can check what is in the folder behind the mountpoint without having to unmount the disk/partitions (which can be nice if for example you would have to unmount /usr). Just do a

# mount --bind / /mnt
# du -shx /mnt

also as a side note:

# du -shx /

does the same as your du... but is quite a bit shorter (-s stands for summarize)

link|improve this answer
this was exactly it, thanks. the --bind flag was also very helpful - I would have had a much harder time finding it without it. – wes Aug 11 '11 at 15:31
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.