Stephen Harris wrote:
On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance wrote:
2 of my Centos4 servers are showing weird behavior.
[root@server1 ~]# du -sh /var/ 1.8G /var/ [root@server1 ~]# df -h /var Filesystem Size Used Avail Use% Mounted on /dev/sda7 4.3G 3.9G 181M 96% /var
There are two things to consider.
ONE
If you have large block sizes and lots and lots of small files then "du" will report a number quite a lot smaller than "df". "df" reports on actually amount free; "du" reports on apparent size of the files used.
TWO
If you delete a file that is still "open" (typically a log file, or a file being written to in /var/tmp) then Unix doesn't actually delete the file at that point; it removes the directory entry and marks the file to be deleted when no one is using it any more.
I've seen developers create debug logs in /tmp that grew to 2Gb then delete them to save space... while the program was still writing more debug messages, so they didn't save any space at all.
That was it... I deleted a log that was still opened by syslog, and other by snort.
After restarting snort and syslog, I got the right reading.
diskcheck will not stop bugging me :)
Thanks a lot!
Ugo