Find the cause of the du calculation results that exceed the df command output.

I encountered the following events on Linux:Please let me know if you know.

Event

The df-h command mounts a volume of 50 GB.

When I checked the total size of the directory mounted with the du-h command, it was 59GB.

Question 1

Why did the results calculated in du exceed the volume size?

Question 2

Are these two commands calculated differently?

Tried

du hard links, symbol links and options not to follow
Find command finds all types of f, du calculates individual sizes, and gives the total amount

Imagined cause

linux filesystems

2022-09-30 13:47

2 Answers

That's all I can think of.

There is a file that is still open and deleted.
lsof/path/to/mount/point | grep'(deleted)$

There are many files with a large number of extended attributes (including SELinux labels).

getfattr--recursive--no-dereference--dump/path/to/mount/point

There are many files with a large number of ACLs.

getfacl--recursive/path/to/mount/point

The file system is corrupted.

I think there are 1 and 4 in most cases, but I have never seen 2 and 3.
By the way, extended attributes and ACLs are stored in inode if they are small in number and size.(Depends on file system type and inode size.XFS or ext4)

for Linux

2022-09-30 13:47

If you are mounting another volume in a subdirectory in the mounting point (=measurement point) directory of a volume, you may expect the result of du to exceed the result of df.

For example, the result of du exceeds the result of df:

Filesystem Size Used Avail Use % Mounted on
/dev/sda350G 40G 10G 80%/var
/dev/sda420G 18G 2G 90%/var/log

df-h/var becomes 50G.(50GB Size)
du-sh/var becomes 58G (Total Used 40G and 18G values)

2022-09-30 13:47

If you have any answers or tips

Popular Tags

python x 4647

android x 1593

java x 1494

javascript x 1427

c x 927

c++ x 878

ruby-on-rails x 696

php x 692

python3 x 685

html x 656