du and df show different sizes

du and df show different sizes

ncdu / du and df show different sizes:

  • du is reading information from the directory tree, it is more accurate than df but slower.
  • df reads meta data of the file system therefore it is faster, but not that accurate because it works with blocks.

Notable differences between du and df output usually happen because a file was deleted, but the processes that were writing data into that file are still active.

Since the file got deleted, du does not see an entry in directory tree and therefor can’t count it in it’s results, but since the process is still active, blocks are busy and df will count it as in use.

Example:

ncdu

ncdu

In this screenshot you can clearly see that ncdu reports disk usage to be 65GB

df

df

And in this screenshot taken on the same server, you can see that df reports disk usage at 76GB

You can check for remaining processes using lsof +L1 – a specification of the form +L1 will select unlinked open files on the specified file system.

When it comes to deleted log files, from my experience Apache and Nginx processes are most common source for this issue. To resolve the issue with du and df show different sizes, simply restart these services:

lsof +L1

Conclusion: Be careful when removing log files, because they are actively used by various services. Here are some ways to safely empty log files:

truncate -s 0 some-file.log

or

echo -n "" > some-file.log
Written by
Stefan Pejcic
Join the discussion

I enjoy constructive responses and professional comments to my posts, and invite anyone to comment or link to my site.