0

Here is my df -g output:

df -g /var
Filesystem    GB blocks      Free %Used    Iused %Iused Mounted on
/dev/hd9var        3.50      0.10   98%     6376     18% /var

But if a enter in the mount point and issue du command, I get the following output

ux-zzz02:/var>du -sm .
374.38  .
ux-zzz02:/var>

How can this happen? I have only 374mb being used but df command says it's used 98% of 3.50gb

Improve this question
3
  • Sometime this happens if du does not have permission to enter a directory.
    – ctrl-alt-delor
    Feb 2, 2020 at 8:32
  • @ctrl-alt-delor I have been with root user
    – Potter
    Feb 2, 2020 at 17:58
  • @DaniloNeto per the note that mattdm linked to, did you delete any log files recently? Those may have been held open by existing processes.
    – Jeff Schaller ♦
    Feb 3, 2020 at 12:12

2 Answers 2

Reset to default
1

"lsof" is all that you need....

lsof | grep -i delete

The output will show you if some file(s) still in use have been deleted.

Regards

Improve this answer
4
  • Notice that the user is on AIX. There is by default no lsof command on AIX, AFAIK.
    – Kusalananda ♦
    Feb 2, 2020 at 10:11
  • 1
    Indeed, it's not provided directly any more; it used to be on the AIX Toolbox for Linux Applications. Per this forum post, it's been removed.
    – Jeff Schaller ♦
    Feb 3, 2020 at 12:09
  • 3
    As an alternative to lsof, use fuser -dV /var which also shows deleted files with open filehandles for a given mountpoint/filesystem.
    – doktor5000
    Feb 3, 2020 at 14:50
  • lsof can be compiled from source, and OP had root access, so this answer might be usable.
    – Lorinczy Zsigmond
    Feb 4, 2020 at 8:18
1

Do you have mount points inside /var?

When you mount something on a directory it does not matter if the directory is empty or not, it just mounts what you told it to mount. According to this you may have mounted something on a directory which was not empty and have a lot of files or just a few files that occupy a lot of space. Using du won't take into account those files since it will only see the files on the mounted fs, and that may be the "unjustified" discrepancy between those two commands.

Try unmounting those directories and checking if you have files there.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .