[CentOS] very large difference between df and du (10 GB, hard to believe)

Mon Feb 1 15:29:18 UTC 2010
Robert Grasso <robert.grasso+nv at cedrat.com>

Hello,

I have a small server running a tool (RT : perl + mysql + apache) for our support team. I stripped down everything else. The OS is
CentOS 4.8. I noticed a difference between df and du which is hard to believe :

according to df, I am using 29 GB


[root at cedrat-rt ~]$ df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda1              33G   29G  2.8G  92% /
none                  506M     0  506M   0% /dev/shm

(there are no other partitions - ok, I could have partitioned it a bit more)

but according to 

du -kshxc /*

my largest directory is /var (because of mysql) and the grand total is

19 GB

I have a 10 GB difference between both outputs.

I verified with

tune2fs -l /dev/sda1
(...)
Block count:              8703205
Reserved block count:     435160

that is, the ordinary 5%

the journal size :

debugfs -R "stat <8>" /dev/sda1

yields 

Size: 33554432 with a block size of 4096, this gives 128 MB

I rebooted on the CentOS v4.8 CD #1, started "linux rescue" :

mounting /dev/sda1, I get the same 29 GB used

e2fsck reports a clean filesystem

e2fsck -f does not reports further errors.

Does anybody have a suggestion ?

Best regards
---
Robert GRASSO - System engineer