Main Page | Report this Page
Linux Forum Index  »  Linux Setup  »  Issue: Different space usage results for df and du ...
Page 1 of 1    

Issue: Different space usage results for df and du ...

Author Message
bzaman...
Posted: Wed Oct 14, 2009 12:59 am
Guest
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

===
$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/sys-home 137G 123G 7.2G 95% /home

$ sudo du -shc /home/
34G /home/
34G total
====

Looks like some process is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .


With Thanks in Advance
--Zaman
 
Nico Kadel-Garcia...
Posted: Wed Oct 14, 2009 1:27 am
Guest
On Oct 14, 6:59 am, bzaman <bzaman.las... at (no spam) gmail.com> wrote:
Quote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

==> $ df -h /home/
Filesystem                    Size  Used Avail Use% Mounted on
/dev/mapper/sys-home  137G  123G  7.2G  95% /home

$ sudo du -shc /home/
34G     /home/
34G     total
===
Looks like some process  is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .

With Thanks in Advance
--Zaman
 
Nico Kadel-Garcia...
Posted: Wed Oct 14, 2009 2:11 am
Guest
On Oct 14, 6:59 am, bzaman <bzaman.las... at (no spam) gmail.com> wrote:
Quote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

==> $ df -h /home/
Filesystem                    Size  Used Avail Use% Mounted on
/dev/mapper/sys-home  137G  123G  7.2G  95% /home

$ sudo du -shc /home/
34G     /home/
34G     total
===
Looks like some process  is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .

You could become root and type 'lsof | grep /home'. This will tell
you the names of files in /home held open by processes, including
deleted files.
 
Nico Kadel-Garcia...
Posted: Wed Oct 14, 2009 2:15 am
Guest
On Oct 14, 8:06 am, "Roger N. Clark (change username to rnclark)"
<usern... at (no spam) qwest.net> wrote:
Quote:
bzaman wrote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

==> > $ df -h /home/
Filesystem                    Size  Used Avail Use% Mounted on
/dev/mapper/sys-home  137G  123G  7.2G  95% /home

$ sudo du -shc /home/
34G        /home/
34G        total
===
Looks like some process  is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .

Zaman,
This can happen if you have a lot of small files that occupy a fraction
of a block.  Du is showing the file size but not the actual disk
space.  For example, if you have a file containing 2 bytes, it still
takes up one block plus an inode.  With a lot of files, also check
that you have enough inodes (df -i).  I'm not sure if this is your
problem, but something to check.  If this is your problem, the only way
to fix it that I know of is to reformat the file system with a smaller
block size.

Roger

This seems unlikely. du counts blocks, and blocks for directory
information. Running out of inodes shows up rather differently.

Another possibility is if there was an old mount point, such as '/home/
httpd', on which another partition has been mounted. The new partition
will be reported by 'du', if you don't use the 'du -x' option, but
open files such as logfiles will remain active *under* the mount point
until their processes release them. This can drive you *nuts* if
people put things like httpd or nagios or log handling in /home/.
 
Roger N. Clark (change username to rnclark)...
Posted: Wed Oct 14, 2009 6:06 am
Guest
bzaman wrote:
Quote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

===
$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/sys-home 137G 123G 7.2G 95% /home

$ sudo du -shc /home/
34G /home/
34G total
====

Looks like some process is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .

Zaman,
This can happen if you have a lot of small files that occupy a fraction
of a block. Du is showing the file size but not the actual disk
space. For example, if you have a file containing 2 bytes, it still
takes up one block plus an inode. With a lot of files, also check
that you have enough inodes (df -i). I'm not sure if this is your
problem, but something to check. If this is your problem, the only way
to fix it that I know of is to reformat the file system with a smaller
block size.

Roger
 
Matt Giwer...
Posted: Wed Oct 14, 2009 7:34 am
Guest
bzaman wrote:
Quote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

===
$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/sys-home 137G 123G 7.2G 95% /home

$ sudo du -shc /home/
34G /home/
34G total
====

Looks like some process is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .

If du = X then df = 1 - X and as rounding is in the same direction then df +
du cannot = 1 because of the rounding. Playing with the switches cannot make
it any better.

I cannot comment on your specific problem but a priori it cannot equal 1.

I can suggest one of the many programs for visualizing disk usage.

I can say I have seen lots of odd results like this and never found an actual
loss of disk space after I reasoned out what was going on.

--
A real American only needs one finger while an Englishman requires two.
-- The Iron Webmaster, 4176
http://www.giwersworld.org a1
Wed Oct 14 09:25:40 EDT 2009
 
Unruh...
Posted: Wed Oct 14, 2009 10:40 am
Guest
bzaman <bzaman.laskar at (no spam) gmail.com> writes:

Quote:
We are seeing a strange problem on one of our Linux production host.

df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

It could be a file which you have deleted but is still open. Those files are
removed from the directory, but the file content is still there and will be
removed when the program closes the file. Eg, you might has erased some huge log
file from /var/log but forgotten to restart the program that had it open.

Solution-- restart that program or Reboot the system.

Quote:
===
$ df -h /home/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/sys-home 137G 123G 7.2G 95% /home

$ sudo du -shc /home/
34G /home/
34G total
====

Looks like some process is not releasing space which it was using .
But not sure how to identify the process which is taking space.
We tried to restart one process which is running for many time , but
is not helping .

Can you guys can suggest some troubleshooting space , commands to
identify and resolve the issue .


Quote:
With Thanks in Advance
--Zaman
 
bzaman...
Posted: Wed Oct 14, 2009 6:08 pm
Guest
Thanks everybody for sharing the suggestions.


On Oct 14, 9:40 pm, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
Quote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
We are seeing a strange problem on one of our Linux production host.
df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

It could be a file which you have deleted but is still open. Those files are
removed from the directory, but the file content is still there and will be
removed when the program closes the file. Eg, you might has erased some huge log
file from /var/log but forgotten to restart the program that had it open.

Solution-- restart that program  or Reboot the system.


Yep . We restarted all the process which we are having doubt that
may not be releasing space but it was not helping us. Eventually we
rebooted the host which resolved the problem .
probably next time if the problem occurs , we will try to mount/
umount the partition instead of a reboot.


Thanks everybody , once again.
 
bzaman...
Posted: Wed Oct 14, 2009 7:33 pm
Guest
On Oct 15, 9:58 am, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
Quote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
Thanks everybody for sharing the suggestions.
On Oct 14, 9:40=A0pm, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
We are seeing a strange problem on one of our Linux production host.
df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

It could be a file which you have deleted but is still open. Those files > >are
removed from the directory, but the file content is still there and will > >be
removed when the program closes the file. Eg, you might has erased some h> >uge log
file from /var/log but forgotten to restart the program that had it open.

Solution-- restart that program =A0or Reboot the system.

Yep .  We restarted all the process which we are having doubt  that
may not be releasing space but it was not helping us. Eventually we
rebooted the host which resolved the problem .
probably next time if the problem occurs , we will try to mount/
umount the partition instead of a reboot.

It will just refuse to let you unmount because the partition is in use.
Have you figured out which partition it was that was the problem. You need to
discover which program it was that did this so you can prevent it next time.
It clearly was not one of the ones that you restarted. Which was it and why did it
have such a huge file open?

The partition was /home . We have some native applications which
reads from file and transfer the data to a different machine . The
process is not a daemon but runs continuously reading and writing
files. We are suspecting those processes only. We restarted those
processes , but it was not helping . So , we rebooted the host which
resolved the problem . Next time , if the problem reoccurs , we
thought of trying a mount/umount instead of a reboot. We will stop
the process before trying to umount /home partition . Also , will try
to figure out which processes are using /home and are not releasing
space. Probably , `fuser' and 'lsof' should
help us in this regard.


Thank You
Zaman
 
Unruh...
Posted: Wed Oct 14, 2009 10:58 pm
Guest
bzaman <bzaman.laskar at (no spam) gmail.com> writes:

Quote:
Thanks everybody for sharing the suggestions.


Quote:
On Oct 14, 9:40=A0pm, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
We are seeing a strange problem on one of our Linux production host.
df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

It could be a file which you have deleted but is still open. Those files =
are
removed from the directory, but the file content is still there and will =
be
removed when the program closes the file. Eg, you might has erased some h=
uge log
file from /var/log but forgotten to restart the program that had it open.

Solution-- restart that program =A0or Reboot the system.


Yep . We restarted all the process which we are having doubt that
may not be releasing space but it was not helping us. Eventually we
rebooted the host which resolved the problem .
probably next time if the problem occurs , we will try to mount/
umount the partition instead of a reboot.

It will just refuse to let you unmount because the partition is in use.
Have you figured out which partition it was that was the problem. You need to
discover which program it was that did this so you can prevent it next time.
It clearly was not one of the ones that you restarted. Which was it and why did it
have such a huge file open?




>Thanks everybody , once again.
 
Doug Freyburger...
Posted: Thu Oct 15, 2009 9:09 am
Guest
bzaman wrote:
Quote:

... Also , will try
to figure out which processes are using /home and are not releasing
space. Probably , `fuser' and 'lsof' should help us in this regard.

Repeating advice already given in this thread -

lsof | grep /home

will tell you all processes that have files open on the partition.
The list will even include processes that have deleted files open.

lsof - One of the sysadmin wonder tools. Like find and ls it has a
command line whose man page goes on for days. It is *well* worth
spending the days it takes to learn it.
 
Unruh...
Posted: Thu Oct 15, 2009 10:43 am
Guest
bzaman <bzaman.laskar at (no spam) gmail.com> writes:

Quote:
On Oct 15, 9:58=A0am, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
Thanks everybody for sharing the suggestions.
On Oct 14, 9:40=3DA0pm, Unruh <unruh-s... at (no spam) physics.ubc.ca> wrote:
bzaman <bzaman.las... at (no spam) gmail.com> writes:
We are seeing a strange problem on one of our Linux production host.
df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had
taken the rest of space.

It could be a file which you have deleted but is still open. Those fil=
es =3D
are
removed from the directory, but the file content is still there and wi=
ll =3D
be
removed when the program closes the file. Eg, you might has erased som=
e h=3D
uge log
file from /var/log but forgotten to restart the program that had it op=
en.

Solution-- restart that program =3DA0or Reboot the system.

Yep . =A0We restarted all the process which we are having doubt =A0that
may not be releasing space but it was not helping us. Eventually we
rebooted the host which resolved the problem .
probably next time if the problem occurs , we will try to mount/
umount the partition instead of a reboot.

It will just refuse to let you unmount because the partition is in use.
Have you figured out which partition it was that was the problem. You nee=
d to
discover which program it was that did this so you can prevent it next ti=
me.
It clearly was not one of the ones that you restarted. Which was it and w=
hy did it
have such a huge file open?

The partition was /home . We have some native applications which
reads from file and transfer the data to a different machine . The
process is not a daemon but runs continuously reading and writing
files. We are suspecting those processes only. We restarted those
processes , but it was not helping . So , we rebooted the host which
resolved the problem . Next time , if the problem reoccurs , we
thought of trying a mount/umount instead of a reboot. We will stop
the process before trying to umount /home partition . Also , will try
to figure out which processes are using /home and are not releasing
space. Probably , `fuser' and 'lsof' should
help us in this regard.

You tried to stop the process (I presume by stop you meant that you killed it or
in some other way removed it from the process tree rather than just say ^Z it.)
That should have closed all files. If it did not, then that suggests that some
other process had the hidden file open. umount will not unmount a partition which
has any opened files on it, including such hidden files.



Quote:
Thank You
Zaman
 
Michael Paoli...
Posted: Tue Nov 03, 2009 7:15 am
Guest
On Oct 14, 2:59 am, bzaman <bzaman.laskar at (no spam) gmail.com> wrote:
Quote:
df -h is showing 95% full ( Used- 123G ) for home directory but du is
showing only 34G used for /home. Could not able to identify who had

This situation is most commonly caused by unlinked open file(s), e.g.:
$ df -k .; du -s -x .
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 257792 108 257684 1% /tmp
68 .
$ dd if=/dev/zero of=nulls bs=4096 count=50000
50000+0 records in
50000+0 records out
204800000 bytes transferred in 0.403673 seconds (507341242 bytes/sec)
$ df -k .; du -s -x .
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 257792 200308 57484 78% /tmp
200268 .
$ sleep 9999 < nulls &
[11] 8671
$ rm nulls
$ df -k .; du -s -x .
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 257792 200308 57484 78% /tmp
68 .
$ kill 8671
$ df -k .; du -s -x .
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 257792 108 257684 1% /tmp
[11] Terminated sleep 9999 <nulls
68 .
$

references:
news:d4a4689f-9d54-4053-b6d5-f07f825f49d8 at (no spam) x6g2000pre.googlegroups.com
creat(2)
df(1)
du(1)
ftruncate(2)
link(2)
ln(1)
mv(1)
open(2)
rename(2)
sh(1)
truncate(2)
unlink(2)
 
 
Page 1 of 1    
All times are GMT - 5 Hours
The time now is Thu Nov 26, 2009 10:12 am