Linux filesystem; difference in calculating size using df & du

Solution 1:

When files are deleted in *nix, they continue to live on disk (and take up disk space) for as long as a process has them open. It's fairly common to take advantage of this to "secure" temp files by creating them with a small size, deleting them, and then using the deleted file to store data without having to worry about other processes (easily) getting access to it, so the amount of space in deleted files can grow pretty large if, say, a temp database or multimedia editing session is being handled in this way. Another possibility for how you could have so much "lost" space would be if the system has been upgraded (multiple times) without rebooting or restarting programs, resulting in all your old .so libraries being held open by programs which were started prior to the upgrade and are still running.

df sees the space used by these files because it just looks at how much space is allocated on the device, but du doesn't see them because there aren't any corresponding directory entries.

"Hidden" used space like this can only be freed up when processes that have deleted files open close them. You can find these processes with the fuser command and terminate them (or, for many daemons, send a signal telling them to close and re-open any open files).

Solution 2:

There have been times when if the disk gets full, it can then be confused till reboot/remount that the disk is still full, even when you've deleted a load of files.

Solution 3:

On my side, I simply restarted syslogd to get the disk space back. I had 3GB missing ! My server was up and running for 250 days old.