On Mon, 12 Nov 2001, Jukka Marin wrote:

> On Mon, Nov 12, 2001 at 11:53:19AM +0100, Adam Majewski wrote:
> >  du says that in use is 3168104 k
> >  df says that in use is 3870832 k
> >
> >  difference is about 700 MB, anybody know why?
>
> You have a file which you have deleted, but which is still kept open
> by some process, so it can't be removed from the disk.  du can't see
> this file (it has no directory entry), but df still accounts the space
> used by the file.

Further, if that's the case, you can find out which process is holding the
file.

Run 'fsck -n' on the raw device containing the partition with the space
discrepancy.

If there is an open file which does not appear in any directory, you'll
get output like this in Phase 4 of fsck:

UNREF FILE I=183  OWNER=root MODE=100664
SIZE=1048576 MTIME=Nov 12 22:37 2001
CLEAR? no

Look for UNREF files with largish sizes.  Note the inode number (I=###).

Now you can scan the system's open files to see who's holding a reference
to that inode number:

# fstat | egrep 'INUM| ###'

If you kill the processes listed (or persuade them to close their files),
you should see df and du giving closer numbers.  They'll never be exactly
the same due to slight differences in the way that du and df count and
because of the reserved space (see -m flag to tunefs).
-- 
Tod McQuillin