Since df reports the correct number after rebooting, I'd tend to think that
it is a file that was opened by a process, and then deleted(my original
suspicion).

Is there a method of determining which process it may be?

I am using newsyslog to rotate my logs.  Another possibility is mail, which
is on the same /var partition.  I can't think of any other files on that
partition that would be constantly created and deleted.

----- Original Message -----
From: Bill Sommerfeld <sommerfeld@orchard.arlington.ma.us>
To: James Webster <James3838@tsi-net.com>
Cc: <port-i386@netbsd.org>
Sent: Wednesday, February 10, 1999 8:41 AM
Subject: Re: df and du out of sync


> > I've noticed that when I keep my system (1.3.2) up for long periods of
> > times, the number of blocks listed in use by df and du differ by a large
> > margin.  This is especially true on my log file partition.  Is this a
known
> > issue, and which is reporting the correct amount?
>
> This sounds like there are files which are open by some process but
> which have been deleted.
>
> You mention that this happens a lot on your log file partition.
>
> Are you running cronjobs to periodically rotate log files written by
> long-running daemons?  The usual approach here (used by
> syslog/newsyslog, for instance) is for the script to send a signal to
> the daemon writing to the logs to get it to close & reopen the files.
>
> - Bill
>