My system is CentOS 6 x86_64 with root partition formatted as ext4.
df
reports around 3Gb as used space:
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/md1 20158260 3433724 15700540 18% /
but du -sm -x /
claims less than a single Gb is used actually:
[root@xxxx ~]# du -sm -x /
948 /
I wonder what is going on here. Usage numbers changed right after reboot. The filesystem claims it's clean, no errors in logs. I found this, but it did not explain a root of the problem. Should I just reformat the partition? Is there any way to track down this extra usage?
I also did the following to check that I don't have any data hidden from du
by mounts on top of non-empty mountpoints:
[root@xxxx ~]# mount -o bind / /mnt/root
[root@xxxx ~]# du -sm /mnt/root/
949 /mnt/root/
[root@xxxx ~]#
No, that's not my case.
The first thing I would think is that you have deleted files. Using
lsof -n | grep deleted
will help you. Does the output of that command shows you some files? (maybe you have a huge log file still being written). If you have files opened by a process (a syslogger or something like Apache web server) that are being written into they may be using a lot of disk space and the easies way will be restarting the process owning of those deleted files.If there aren't any deleted files, could you paste the output of running
tune2fs -l
?Force a filesystem check on next reboot. You may have unrecovered inodes that are holding data.
source: http://ubuntuforums.org/showthread.php?t=1360204&p=9209650#post9209650
Ext3/4 can use up to 400MB for the journal file, which you can not see. The size of the journal size is automatically scaled with the size of the filesystem created or can be manually specified at filesystem creation time.
Today I had a similar issue with a couple of hosts that are running an application which someone had deleted the .tmp files that it produces but the process still had a file handle open which I found via lsof, when i restarted the process the disk space was released. lsof was a good place to start with figuring this issue out -