14

Under what circumstances would ls -lh show a total that is less than the sum of the individual files? For example:

$ ls -lh /var/lib/nova/instances/_base
total 100G
-rw-rw-r-- 1 nova         nova 4.3M 2012-02-14 14:07 00000001
-rw-rw-r-- 1 nova         nova 5.7M 2012-02-14 14:07 00000002
-rw-rw-r-- 1 nova         nova  42G 2012-03-08 15:24 1574bddb75c78a6fd2251d61e2993b5146201319.part
-rw-rw-r-- 1 libvirt-qemu kvm   24M 2012-02-14 14:07 77de68daecd823babbb58edb1c8e14d7106e83bb_sm
-rw-r--r-- 1 libvirt-qemu kvm   65G 2012-03-02 12:43 bd307a3ec329e10a2cff8fb87480823da114f8f4
-rw-rw-r-- 1 libvirt-qemu kvm  160G 2012-02-24 16:06 ephemeral_0_160_None
-rw-rw-r-- 1 libvirt-qemu kvm   80G 2012-02-24 22:38 ephemeral_0_80_None
-rw-r--r-- 1 libvirt-qemu kvm   10G 2012-02-24 22:37 fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f
-rw-r--r-- 1 libvirt-qemu kvm   10G 2012-02-24 11:09 fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f_sm

Edit: now showing some extra flags are per request in comment:

$ ls -aiFlh  /var/lib/nova/instances/_base/
total 143G
29884440 drwxrwxr-x 2 nova         nova 4.0K 2012-03-08 15:45 ./
29884427 drwxr-xr-x 6 nova         nova 4.0K 2012-03-08 15:05 ../
29884444 -rw-rw-r-- 1 nova         nova 4.3M 2012-02-14 14:07 00000001
29884445 -rw-rw-r-- 1 nova         nova 5.7M 2012-02-14 14:07 00000002
29884468 -rw-r--r-- 1 nova         nova  65G 2012-03-08 15:59 1574bddb75c78a6fd2251d61e2993b5146201319.converted
29884466 -rw-rw-r-- 1 nova         nova  58G 2012-03-08 15:35 1574bddb75c78a6fd2251d61e2993b5146201319.part
29884446 -rw-rw-r-- 1 libvirt-qemu kvm   24M 2012-02-14 14:07 77de68daecd823babbb58edb1c8e14d7106e83bb_sm
29884467 -rw-r--r-- 1 libvirt-qemu kvm   65G 2012-03-02 12:43 bd307a3ec329e10a2cff8fb87480823da114f8f4
29884443 -rw-rw-r-- 1 libvirt-qemu kvm  160G 2012-02-24 16:06 ephemeral_0_160_None
29884442 -rw-rw-r-- 1 libvirt-qemu kvm   80G 2012-02-24 22:38 ephemeral_0_80_None
29884447 -rw-r--r-- 1 libvirt-qemu kvm   10G 2012-02-24 22:37 fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f
29884441 -rw-r--r-- 1 libvirt-qemu kvm   10G 2012-02-24 11:09 fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f_sm
3
  • don't know if any of those are links, could you list ls -aiFl h
    – bsd
    Mar 8 '12 at 20:54
  • @bdowning Added the additional flags. Note there have been some changes to the directory, but the issues is still there Mar 8 '12 at 21:01
  • How about du -h --total for same dir?
    – bsd
    Mar 8 '12 at 21:24
20

It will happen if you have sparse files:

$ mkdir test; cd test
$ truncate -s 1000000000 file-with-zeroes
$ ls -l
total 0
-rw-r--r-- 1 gim gim 1000000000 03-08 22:18 file-with-zeroes

A sparse file is a file which has not been populated with filesystem blocks (or only partially). When you read a non-populated zone of a sparse file you will obtain zeros. Such blank zones do not require actual disk space, and the 'total' reported by ls corresponds to the disk space occupied by the files (just like du).

2
  • 3
    Your kvm disk images are probably full of holes :-) Mar 8 '12 at 21:36
  • The coreutils documentation says that the -s/--size option "Print the disk allocation of each file to the left of the file name. This is the amount of disk space used by the file, which is usually a bit more than the file's size, but it can be less if the file has holes." The -l option of course prints the size, too.
    – user22304
    Sep 21 '12 at 12:45
3

Please note that the output given by ls -l and du has a subtle but very important difference. Try this:

dd if=/dev/urandom of=aaa bs=1024 count=1

Now

ls -l aaa
-rw-r--r-- 1 abc abc 1024 2012-03-08 15:45 aaa

Whereas

du -h aaa
4.0K    aaa

This is because the filesystem allocates size in chunks of 4096 ( on my linux box). It is called IO Block. You can see this by:

    stat aaa
  File: `aaa'
  Size: 1024        Blocks: 8          IO Block: 4096   regular file
3
  • Also, you can try stat on my proposed empty-file, and you'll see that the number of Blocks is 0, even if the file is reported to have a size of 1G. Mar 9 '12 at 0:17
  • @StéphaneGimenez Why does it report Blocks as 8 though? What block is this with size 512 bytes? Mar 9 '12 at 1:18
  • 1
    It's a bit strange, In the old times, IO blocks had size 512, but now they are usually 4K. stat reports the equivalent number of old sized block needed to store all the 4K blocks (that is 8 times the real number of 4K blocks). Mar 9 '12 at 9:21
2

The currently accepted answer is absolutely correct, just if you want to see apparent size, you can use:

du --apparent-size

print apparent sizes, rather than disk usage; although the apparent size is usually smaller, it may be larger due to holes in ('sparse') files, internal fragmentation, indirect blocks, and the like

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.