Why is the disk space reported different when running du vs. df?

Question

Why is the disk space reported differently when running du vs. df?

Answer

The file system allocates disk blocks in the file system to record its data. This data is referred to as metadata, which is not visible to most user-level programs. Metadata includes inodes, disk maps, indirect blocks, superblocks, etc.

The du command is a user-level program that isn't aware of filesystem metadata while df looks at the filesystem disk allocation maps and is aware of file system metadata. df obtains true filesystem statistics, whereas du sees only a partial picture.

There are many reasons why the disk space used or available when running the du or df commands differs. A few of the most common reasons are listed below.

• Files deleted while open

  Files that have been deleted may still be open by at least one process. The entry for such a file is removed from the associated directory. Therefore, the du command does not take these files into account and comes up with a smaller value. As long as a process still has the deleted file in use, the associated blocks are not released in the file system. Because of this, df, which works at the kernel level, correctly displays these as occupied.
  You can find out if this is the case by running the following.

  lsof | grep '(deleted)'

  The fix for this issue would be to restart the services that still have those deleted files open.

• File system mounted on a non-empty directory

  When a file system is mounted on a folder that has content, df will show the space used by each file system. du will see the usage in the mounted file system, but not the usage in the directory the file system was mounted on.

  You can determine if this is the case by using a bind mount to mount the root file system to a temporary folder and then comparing the du usage of that folder to the df output.

• File system corruption

  When a file system is corrupt, df can report incorrect usage information. The system administrator will have to repair the file system to correct this.

Additional resources

Identifying Disk Corruption and Filesystem Errors