Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.

'df -h' shows 210G used, 8.6G avail

'ncdu' shows 28.6G used (same for apparent size)

As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.

Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.

Here is a summary of the output from ncdu:

   22.7GiB [##########] /opt
    2.8GiB [#         ] /usr
    1.5GiB [          ] /var
  812.4MiB [          ] /root
  310.6MiB [          ] /home
  194.3MiB [          ] /lib
  156.4MiB [          ] /etc
   36.5MiB [          ] /sbin
    7.3MiB [          ] /bin
  128.0KiB [          ] /tmp
   20.0KiB [          ] /mnt
e  16.0KiB [          ] /lost+found
e   8.0KiB [          ] /srv
e   8.0KiB [          ] /selinux
    8.0KiB [          ] /media
e   4.0KiB [          ] /backup
>   0.0  B [          ] /sys
>   0.0  B [          ] /proc
>   0.0  B [          ] /net
>   0.0  B [          ] /misc
>   0.0  B [          ] /dev
>   0.0  B [          ] /boot
    0.0  B [          ]  .autorelabel
    0.0  B [          ]  .autofsck

Output of 'df -Th':

Filesystem    Type    Size  Used Avail Use% Mounted on
              ext3    221G  210G  8.6G  97% /
/dev/sda1     ext3     99M   25M   74M  25% /boot
tmpfs        tmpfs    1.7G     0  1.7G   0% /dev/shm

This post mentions that outside of phantom files there are two other possible explanations:

  1. corrupt filesystem
  2. compromised machine

I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.

Thanks for your help!

share|improve this question
Possible duplicate of – user130370 Dec 11 '13 at 8:32
Are you running ncdu with sudo? – user2529583 May 4 at 10:28

You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.