why does sar give me 8.14% of root filesystem used and df -h gives me 9% for the same root filesystem? I was thinking df may be rounding the value, but if so it would be 8%.

localhost one # sar -F 1 1                      
Linux 4.4.26-gentoo (localhost)     05/15/17    _x86_64_    (8 CPU)

18:39:08     MBfsfree  MBfsused   %fsused  %ufsused     Ifree     Iused    %Iused FILESYSTEM
18:39:09       118401     10485      8.14     13.23   7853529    535079      6.38 /dev/mapper/root
18:39:09          463        25      5.14     12.48     32403       365      1.11 /dev/sda1

Summary:     MBfsfree  MBfsused   %fsused  %ufsused     Ifree     Iused    %Iused FILESYSTEM
Summary:       118401     10485      8.14     13.23   7853529    535079      6.38 /dev/mapper/root
Summary:          463        25      5.14     12.48     32403       365      1.11 /dev/sda1

localhost one # df -h
Filesystem        Size  Used Avail Use% Mounted on
udev               10M  4.0K   10M   1% /dev
/dev/mapper/root  126G   11G  110G   9% /
tmpfs             794M  492K  793M   1% /run
shm               3.9G   19M  3.9G   1% /dev/shm
cgroup_root        10M     0   10M   0% /sys/fs/cgroup
/dev/sda1         488M   26M  428M   6% /boot

If you divide the used space by the total space, you get 10485/(118401+10485) ≈ 0.08135, which sar rounds to 8.14%.

By default, on an ext2/ext3/ext4 filesystem, 5% of the space is reserved to root. The “Avail” value displayed by the df command does not include this reserved space in the total space (i.e. it performs the calculation based on 95% of the total space, which is all that a non-root user can use), so the calculation it makes is 10485 / ((118401+10485)*0.95) ≈ 0.08563, which is rounded to 9%.

The reserved space allows the system to keep running for a bit after it's almost full. For example, logs can still be written for a while, which can be a big help in diagnosing what filled the disk. For a partition that doesn't contain /var, the reserved space is less useful, but a filesystem that's 95% full is likely to get fragmented anyway, so it's a bad idea for performance to go much beyond that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.