Why is the disk space reported differently when running
The file system allocates disk blocks in the file system to record its data. This data is referred to as metadata, which is not visible to most user-level programs. Metadata includes inodes, disk maps, indirect blocks, superblocks, etc.
du command is a user-level program that isn't aware of filesystem metadata while
df looks at the filesystem disk allocation maps and is aware of file system metadata.
df obtains true filesystem statistics, whereas
du sees only a partial picture.
There are many reasons why the disk space used or available when running the du or df commands differs. A few of the most common reasons are listed below.
Files deleted while open
Files that have been deleted may still be open by at least one process. The entry for such a file is removed from the associated directory. Therefore, the
ducommand does not take these files into account and comes up with a smaller value. As long as a process still has the deleted file in use, the associated blocks are not released in the file system. Because of this,
df, which works at the kernel level, correctly displays these as occupied.
You can find out if this is the case by running the following.
lsof | grep '(deleted)'
The fix for this issue would be to restart the services that still have those deleted files open.
File system mounted on a non-empty directory
When a file system is mounted on a folder that has content,
dfwill show the space used by each file system.
duwill see the usage in the mounted file system, but not the usage in the directory the file system was mounted on.
You can determine if this is the case by using a bind mount to mount the root file system to a temporary folder and then comparing the
duusage of that folder to the
File system corruption
When a file system is corrupt,
dfcan report incorrect usage information. The system administrator will have to repair the file system to correct this.