Find the cause of the du calculation results that exceed the df command output.

Asked 2 months ago, Updated 2 months ago, 3 views

I encountered the following events on Linux:Please let me know if you know.

Event

The df-h command mounts a volume of 50 GB.

When I checked the total size of the directory mounted with the du-h command, it was 59GB.

Question 1

Why did the results calculated in du exceed the volume size?

Question 2

Are these two commands calculated differently?

Tried

  • du hard links, symbol links and options not to follow
  • Find command finds all types of f, du calculates individual sizes, and gives the total amount

Imagined cause

linux filesystems

2022-09-30 13:47

2 Answers

That's all I can think of.

There is a file that is still open and deleted.
lsof/path/to/mount/point | grep'(deleted)$

There are many files with a large number of extended attributes (including SELinux labels).

getfattr--recursive--no-dereference--dump/path/to/mount/point

There are many files with a large number of ACLs.

getfacl--recursive/path/to/mount/point

The file system is corrupted.

I think there are 1 and 4 in most cases, but I have never seen 2 and 3.
By the way, extended attributes and ACLs are stored in inode if they are small in number and size.(Depends on file system type and inode size.XFS or ext4)

for Linux


2022-09-30 13:47

If you are mounting another volume in a subdirectory in the mounting point (=measurement point) directory of a volume, you may expect the result of du to exceed the result of df.

For example, the result of du exceeds the result of df:

Filesystem Size Used Avail Use % Mounted on
/dev/sda350G 40G 10G 80%/var
/dev/sda420G 18G 2G 90%/var/log
  • df-h/var becomes 50G.(50GB Size)
  • du-sh/var becomes 58G (Total Used 40G and 18G values)


2022-09-30 13:47

If you have any answers or tips


© 2022 OneMinuteCode. All rights reserved.