From owner-freebsd-questions Sun Oct 28 19:44:51 2001 Delivered-To: freebsd-questions@freebsd.org Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13]) by hub.freebsd.org (Postfix) with ESMTP id D7BD637B403 for ; Sun, 28 Oct 2001 19:44:47 -0800 (PST) Received: from localhost (davidk@localhost) by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f9T3ikG35978; Sun, 28 Oct 2001 19:44:46 -0800 (PST) Date: Sun, 28 Oct 2001 19:44:46 -0800 (PST) From: David Kirchner X-X-Sender: To: Erik Rothwell Cc: Subject: Re: Discrepancies between 'df' and 'du'... In-Reply-To: <20011028095502.L33281-100000@endymion> Message-ID: <20011028194357.W35308-100000@localhost> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sun, 28 Oct 2001, Erik Rothwell wrote: > Hi folks, > > I just noticed something really odd... if I run "df /var" I get this > output: > > Filesystem 1K-blocks Used Avail Capacity Mounted on > /dev/ad0s1e 99183 89342 1907 98% /var] > > However, if I do something like "du -skh /var" the result is: > > 17M /var > > That's a rather significant difference. As far as I can tell, the contents > of /var (not including symlinks to data on other filesystems) does not > include more than 17MB worth of data... is there any obvious reason why df > might report otherwise? > > Thanks... > > Erik. The most common reason for this is that you rm'd a file that is still held open by an application. Given that this is /var, I'll guess that it was syslogd. Check out 'fstat /var' or 'lsof' (from ports) to see what unlinked files are still open. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message