ncdu / du and df show different sizes:
- du is reading information from the directory tree, it is more accurate than df but slower.
- df reads meta data of the file system therefore it is faster, but not that accurate because it works with blocks.
Notable differences between du and df output usually happen because a file was deleted, but the processes that were writing data into that file are still active.
Since the file got deleted, du does not see an entry in directory tree and therefor can’t count it in it’s results, but since the process is still active, blocks are busy and df will count it as in use.
Example:
ncdu
In this screenshot you can clearly see that ncdu reports disk usage to be 65GB
df
And in this screenshot taken on the same server, you can see that df reports disk usage at 76GB
You can check for remaining processes using lsof +L1 – a specification of the form +L1 will select unlinked open files on the specified file system.
When it comes to deleted log files, from my experience Apache and Nginx processes are most common source for this issue. To resolve the issue with du and df show different sizes, simply restart these services:
Conclusion: Be careful when removing log files, because they are actively used by various services. Here are some ways to safely empty log files:
truncate -s 0 some-file.logor
echo -n "" > some-file.log