File system bafflement

[Robert Heller]

At Tue, 2 Sep 2014 17:47:31 +0100 "Ubuntu user technical support,  not for general discussions" <ubuntu-users at lists.ubuntu.com> wrote:

> 
> On Tue, 2 Sep 2014 16:43:16 +0100
> Chris Green wrote:
> 
> > > There's probably a clever way to work around that, but until I
> > > figure it out, I would suggest booting from a live cd and examining
> > 
> > Yes, there is:-
> > 
> >     du -xk --max-depth=1 /
> > 
> > The --max-depth prevents the du returning space used on other file
> > systems.
> 
> Thanks. Using -h as well I get:-
> 
> 4.0K    /mnt
> 16K     /lost+found
> 136M    /opt
> 9.7M    /bin
> 3.5M    /lib32
> 51M     /root
> 16K     /media
> 4.0K    /lib64
> 4.0K    /srv
> 12M     /sbin
> 93M     /boot
> 78M     /etc
> 705M    /lib
> 8.0K    /mount
> 1.1G    /
> 
> So it seems there is plenty of space (nearly 3G). Yet df is reporting 100%
> is used.

All it takes is an open file that has been unlinked (ala rm). So long as the
file is open, the space is in use (and df will include that space as used),
but if there is no directory entry (eg the file *name* has been removed
[unlinked]), du won't see the space as used. This often happens when syslogd's
log file(s) are deleted *without* sending syslogd a HUP signal.

Also, df takes into account the free space reserved for root.  In other words, 
df will always report a file system that is more used than it actually is -- 
df *by design* overstates a file system's usage.

> 
> - Richard

-- 
Robert Heller             -- 978-544-6933
Deepwoods Software        -- Custom Software Services
http://www.deepsoft.com/  -- Linux Administration Services
heller at deepsoft.com       -- Webhosting Services