Df -h and du showing different result

We may come across the situation in which “du -sch” and “df -h” will show different result.

In our case, we can take the example of /var partition.

/dev/sda3             146G  144G     0 100% /var

But, du -sch result show only 82 GB.

# du -sch *
7.8G    cpanel
70G     lib
7.1G    lve
86G     total

The difference is that whenever an application has an open file, but the file is already deleted, then it is counted in the df output (because the space is certainly not free) but not in du (because it is not being used by a file).

The problem we will face here is mysql may not start. Here we cannot kill all the processes of mysql and free up /var partition.

But, the real issue is when /var is used by a process which we cannot kill. For example, lets take r1soft backup is running. In that case we cannot kill those processes because it will create issue with replication of data.

So, use the following command to find out the files, which is using large space.

lsof | grep deleted | grep var
cdp-2-6     783208     root  txt       REG       8,2    2497576960  6033403 (deleted) /var/r1soft/bin/2-6/cdp-2-6

Now, go to the file descriptor of that particular process.

# cd /proc/783210/fd
[/proc/783208/fd]# ll
total 0
dr-x------ 2 root root  0 May  6 04:16 ./
dr-xr-xr-x 5 root root  0 May  5 16:48 ../
lrwx------ 1 root root 64 May  6 04:16 10 -> /dev/hcp
lrwx------ 1 root root 64 May  6 04:16 11 -> (deleted)\ /var/.r1soft_hcp_sda3.cow_hcp1_1

10 –> points to /dev/hcp 11 –> points to /var/.r1soft_hcp_sda3.cow_hcp1_1

which is actually deleted. Now, just null those files as


Now, see the result.

# df -h | grep var
//dev/sda3             146G   86G   53G  63% /var

Done 🙂

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: