Stephen Harris wrote: > On Wed, Nov 21, 2007 at 07:37:31PM -0500, Ugo Bellavance wrote: >> 2 of my Centos4 servers are showing weird behavior. >> >> [root at server1 ~]# du -sh /var/ >> 1.8G /var/ >> [root at server1 ~]# df -h /var >> Filesystem Size Used Avail Use% Mounted on >> /dev/sda7 4.3G 3.9G 181M 96% /var > > There are two things to consider. > > ONE > === > > If you have large block sizes and lots and lots of small files then > "du" will report a number quite a lot smaller than "df". "df" reports > on actually amount free; "du" reports on apparent size of the files used. > > TWO > === > > If you delete a file that is still "open" (typically a log file, or > a file being written to in /var/tmp) then Unix doesn't actually delete > the file at that point; it removes the directory entry and marks the file > to be deleted when no one is using it any more. > > I've seen developers create debug logs in /tmp that grew to 2Gb then > delete them to save space... while the program was still writing more > debug messages, so they didn't save any space at all. > That was it... I deleted a log that was still opened by syslog, and other by snort. After restarting snort and syslog, I got the right reading. diskcheck will not stop bugging me :) Thanks a lot! Ugo