From owner-freebsd-fs@FreeBSD.ORG Tue Oct 16 16:30:08 2007 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3B4AB16A418 for ; Tue, 16 Oct 2007 16:30:08 +0000 (UTC) (envelope-from bv@bilver.wjv.com) Received: from wjv.com (fl-65-40-24-38.sta.embarqhsd.net [65.40.24.38]) by mx1.freebsd.org (Postfix) with ESMTP id B5FB513C459 for ; Tue, 16 Oct 2007 16:30:07 +0000 (UTC) (envelope-from bv@bilver.wjv.com) Received: from bilver.wjv.com (localhost.wjv.com [127.0.0.1]) by wjv.com (8.14.1/8.13.1) with ESMTP id l9GGTrpB079356; Tue, 16 Oct 2007 12:29:53 -0400 (EDT) (envelope-from bv@bilver.wjv.com) Received: (from bv@localhost) by bilver.wjv.com (8.14.1/8.13.1/Submit) id l9GGTmDP079355; Tue, 16 Oct 2007 12:29:48 -0400 (EDT) (envelope-from bv) Date: Tue, 16 Oct 2007 12:29:48 -0400 From: Bill Vermillion To: Paul Kupfer Message-ID: <20071016162948.GA79131@wjv.com> References: <20071016114035.O64828@lorax.ldc.upenn.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20071016114035.O64828@lorax.ldc.upenn.edu> User-Agent: Mutt/1.4.2.2i Organization: W.J.Vermillion / Orlando - Winter Park ReplyTo: bv@wjv.com Cc: freebsd-fs@freebsd.org Subject: Re: du and df discrepancy X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: bv@wjv.com List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Oct 2007 16:30:08 -0000 On Tue, Oct 16, 2007 at 11:49 Paul Kupfer saw "Error reading FAT table? Try SKINNY table?" And promptly said: > I am seeing a very odd problem on a FreeBSD 6.1-PRERELEASE #0 > mail server we have. We originally had a separate scsi device > mounted as /var/mail (note this was underneath the mountpoint > for /var). We reached a point where space on /var was running > out, and running a df on that volume would show that there was > only 160M out of 5.8G available (and 5.2G used). > So I ran "du -hc /var" to see where I could remove some old > files. du output shows the total of /var to be 311M, which is > vastly different than what du tells me. I thought that this was > perhaps a result of the way we had things mounted, and so I > unmount the /var/mail device and remounted it as /mail, then put > a symlink from /mail to /var/mail, still no dice, same results. > I have not rebooted the machine yet (was hoping I wouldn't have > to since it is a mail server). Is it possible that the inode > tables are "out of whack" since changing these mountpoints, > perhaps an fsck? Anyone ever seen anything like this before? > Any help would be greatly appreciated. I've seen it many times in my XX years of Unix work. du - shows the amount of blocks used by the system df - shows the amunt of space it thinks is being used. The latter will compute the length of sparse files so df will show less free space than du. Sparse file will have blocks of no data in them. These are typically created by database programs. And if you removed files that were open by some application, you won't be able to see those files but the application will have them open and still be adding to the lenght of the file. When removing files like these - shutdown the ap - remove the file and restart the ap. Depending upon the application - if it's something being run out of syslog, you may have to 'touch' the file, as syslog will not create a missing file unless you give it the -C option - only available in releases after the 4.x series. Bill -- Bill Vermillion - bv @ wjv . com