du vs. df difference [duplicate]

Ok, found it.

I had a old backup on /mnt/Backup in the same filesystem and then an external drive mounted in that place. So du didn't see the files. So cleaning up this gave me back my disk space.

It probably happened this way: the external drive once was unmounted while the daily backup script run.

I don't think you will find a more thorough explanation that then this link for all the reasons it could be off. Some highlights that might help:

• What is your inode usage, if it is almost at 100% that can mess things up:

  df -i

• What is your block size? Lots of small files and a large block size could skew it quite a bit.

  sudo tune2fs -l /dev/sda1 | grep 'Block size'

• Deleted files, you said you investigated this, but to get the total space you could use the following pipeline (I like find instead of lsof just because lsof is a pain to parse):

  sudo find /proc/*/fd -printf "%l\t%s\n" | grep deleted | cut -f2 | (tr '\n' +; echo 0) | bc

However, that is almost 2x off. Run fsck on the partition while it is unmounted to be safe.

It looks like a case of files being removed while processes still have them open. This disconnect happens because the du command totals up space of files that exist in the file system, while df shows blocks available in the file system. The blocks of an open and deleted file are not freed until that file is closed.

You can find what processes have open but deleted files by examining /proc

find /proc/*/fd -ls | grep deleted

The most likely reason in your case is that you have lots of files that are very small (smaller than your block size on the drive). In that case df will report the sum of all used blocks, whereas du will report the actual sum of file sizes.