Near 100% disk usage, df and du show very different results, lsof not the answerdu vs. df differencedisk space keeps filling up on EC2 instance with no apperent files/directoriesVirtualbox disk in CentOS mount/format issue
Multi tool use
Covering index used despite missing column
I just entered the USA without passport control at Atlanta airport
Is the specular reflection on a polished gold sphere white or gold in colour?
Going back in time in and initial value problem
Can I enter the UK for 24 hours from a Schengen area, holding an Indian passport?
Why isn't my calculation that we should be able to see the sun well beyond the observable universe valid?
Why does std::string_view create a dangling view in a ternary expression?
What are the pros and cons for the two possible "gear directions" when parking the car on a hill?
What happened to Hopper's girlfriend in season one?
Find All Possible Unique Combinations of Letters in a Word
Print one file per line using echo
In Mistborn, why can metal in people's bodies be affected by Allomancy sometimes?
Dmesg full of I/O errors, smart ok, four disks affected
What is the "ls" directory in my home directory?
What triggered jesuits' ban on infinitesimals in 1632?
Is the continuity test limit resistance of a multimeter standard?
What is the most suitable position for a bishop here?
"Correct me if I'm wrong"
What is the highest voltage from the power supply a Raspberry Pi 3 B can handle without getting damaged?
Why isn't it a compile-time error to return a nullptr as a std::string?
Has a life raft ever been successfully deployed on a modern commercial flight?
How do internally carried IR missiles acquire a lock?
Dates on degrees don’t make sense – will people care?
Designing a magic-compatible polearm
Near 100% disk usage, df and du show very different results, lsof not the answer
du vs. df differencedisk space keeps filling up on EC2 instance with no apperent files/directoriesVirtualbox disk in CentOS mount/format issue
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.
'df -h' shows 210G used, 8.6G avail
'ncdu' shows 28.6G used (same for apparent size)
As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.
Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.
Here is a summary of the output from ncdu:
22.7GiB [##########] /opt
2.8GiB [# ] /usr
1.5GiB [ ] /var
812.4MiB [ ] /root
310.6MiB [ ] /home
194.3MiB [ ] /lib
156.4MiB [ ] /etc
36.5MiB [ ] /sbin
7.3MiB [ ] /bin
128.0KiB [ ] /tmp
20.0KiB [ ] /mnt
e 16.0KiB [ ] /lost+found
e 8.0KiB [ ] /srv
e 8.0KiB [ ] /selinux
8.0KiB [ ] /media
e 4.0KiB [ ] /backup
> 0.0 B [ ] /sys
> 0.0 B [ ] /proc
> 0.0 B [ ] /net
> 0.0 B [ ] /misc
> 0.0 B [ ] /dev
> 0.0 B [ ] /boot
0.0 B [ ] .autorelabel
0.0 B [ ] .autofsck
Output of 'df -Th':
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
ext3 221G 210G 8.6G 97% /
/dev/sda1 ext3 99M 25M 74M 25% /boot
tmpfs tmpfs 1.7G 0 1.7G 0% /dev/shm
This post mentions that outside of phantom files there are two other possible explanations:
- corrupt filesystem
- compromised machine
I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.
Thanks for your help!
centos5 disk-space-utilization lsof du df
edited Apr 13 '17 at 12:14
Community♦
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
add a comment |
The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.
'df -h' shows 210G used, 8.6G avail
'ncdu' shows 28.6G used (same for apparent size)
As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.
Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.
Here is a summary of the output from ncdu:
22.7GiB [##########] /opt
2.8GiB [# ] /usr
1.5GiB [ ] /var
812.4MiB [ ] /root
310.6MiB [ ] /home
194.3MiB [ ] /lib
156.4MiB [ ] /etc
36.5MiB [ ] /sbin
7.3MiB [ ] /bin
128.0KiB [ ] /tmp
20.0KiB [ ] /mnt
e 16.0KiB [ ] /lost+found
e 8.0KiB [ ] /srv
e 8.0KiB [ ] /selinux
8.0KiB [ ] /media
e 4.0KiB [ ] /backup
> 0.0 B [ ] /sys
> 0.0 B [ ] /proc
> 0.0 B [ ] /net
> 0.0 B [ ] /misc
> 0.0 B [ ] /dev
> 0.0 B [ ] /boot
0.0 B [ ] .autorelabel
0.0 B [ ] .autofsck
Output of 'df -Th':
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
ext3 221G 210G 8.6G 97% /
/dev/sda1 ext3 99M 25M 74M 25% /boot
tmpfs tmpfs 1.7G 0 1.7G 0% /dev/shm
This post mentions that outside of phantom files there are two other possible explanations:
- corrupt filesystem
- compromised machine
I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.
Thanks for your help!
centos5 disk-space-utilization lsof du df
edited Apr 13 '17 at 12:14
Community♦
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Are you runningncduwithsudo?
– Babken Vardanyan
May 4 '16 at 10:28
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
And it's not a reserved block count issue? Check withdumpe2fs.
– Halfgaar
Jun 3 at 11:26
add a comment |
The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.
'df -h' shows 210G used, 8.6G avail
'ncdu' shows 28.6G used (same for apparent size)
As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.
Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.
Here is a summary of the output from ncdu:
22.7GiB [##########] /opt
2.8GiB [# ] /usr
1.5GiB [ ] /var
812.4MiB [ ] /root
310.6MiB [ ] /home
194.3MiB [ ] /lib
156.4MiB [ ] /etc
36.5MiB [ ] /sbin
7.3MiB [ ] /bin
128.0KiB [ ] /tmp
20.0KiB [ ] /mnt
e 16.0KiB [ ] /lost+found
e 8.0KiB [ ] /srv
e 8.0KiB [ ] /selinux
8.0KiB [ ] /media
e 4.0KiB [ ] /backup
> 0.0 B [ ] /sys
> 0.0 B [ ] /proc
> 0.0 B [ ] /net
> 0.0 B [ ] /misc
> 0.0 B [ ] /dev
> 0.0 B [ ] /boot
0.0 B [ ] .autorelabel
0.0 B [ ] .autofsck
Output of 'df -Th':
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
ext3 221G 210G 8.6G 97% /
/dev/sda1 ext3 99M 25M 74M 25% /boot
tmpfs tmpfs 1.7G 0 1.7G 0% /dev/shm
This post mentions that outside of phantom files there are two other possible explanations:
- corrupt filesystem
- compromised machine
I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.
Thanks for your help!
centos5 disk-space-utilization lsof du df
edited Apr 13 '17 at 12:14
Community♦
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have been unable to find a solution.
'df -h' shows 210G used, 8.6G avail
'ncdu' shows 28.6G used (same for apparent size)
As you can see, this is nearly a 10x difference in the reported 'used' space. Knowing what is stored on this drive, I think 28.6G is closer to reality.
Looking at the output of 'lsof' there are very few lines with (deleted) at the end. Moreover, the largest size of any of these lines is 6190. Finally, I've rebooted the machine a number of times which, if I understand the other threads correctly, would resolve the issue of phantom files anyhow.
Here is a summary of the output from ncdu:
22.7GiB [##########] /opt
2.8GiB [# ] /usr
1.5GiB [ ] /var
812.4MiB [ ] /root
310.6MiB [ ] /home
194.3MiB [ ] /lib
156.4MiB [ ] /etc
36.5MiB [ ] /sbin
7.3MiB [ ] /bin
128.0KiB [ ] /tmp
20.0KiB [ ] /mnt
e 16.0KiB [ ] /lost+found
e 8.0KiB [ ] /srv
e 8.0KiB [ ] /selinux
8.0KiB [ ] /media
e 4.0KiB [ ] /backup
> 0.0 B [ ] /sys
> 0.0 B [ ] /proc
> 0.0 B [ ] /net
> 0.0 B [ ] /misc
> 0.0 B [ ] /dev
> 0.0 B [ ] /boot
0.0 B [ ] .autorelabel
0.0 B [ ] .autofsck
Output of 'df -Th':
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
ext3 221G 210G 8.6G 97% /
/dev/sda1 ext3 99M 25M 74M 25% /boot
tmpfs tmpfs 1.7G 0 1.7G 0% /dev/shm
This post mentions that outside of phantom files there are two other possible explanations:
- corrupt filesystem
- compromised machine
I'm looking for help on how to test the validity of these explanations. Obviously, explanation #2 is particularly concerning.
Thanks for your help!
centos5 disk-space-utilization lsof du df
centos5 disk-space-utilization lsof du df
edited Apr 13 '17 at 12:14
Community♦
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
edited Apr 13 '17 at 12:14
Community♦
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
edited Apr 13 '17 at 12:14
Community♦
1
edited Apr 13 '17 at 12:14
Community♦
1
edited Apr 13 '17 at 12:14
Community♦
1
1
asked Dec 11 '13 at 7:02
edwaaedwaa
192
asked Dec 11 '13 at 7:02
edwaaedwaa
192
asked Dec 11 '13 at 7:02
edwaaedwaa
192
192
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Are you runningncduwithsudo?
– Babken Vardanyan
May 4 '16 at 10:28
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
And it's not a reserved block count issue? Check withdumpe2fs.
– Halfgaar
Jun 3 at 11:26
add a comment |
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Are you runningncduwithsudo?
– Babken Vardanyan
May 4 '16 at 10:28
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
And it's not a reserved block count issue? Check withdumpe2fs.
– Halfgaar
Jun 3 at 11:26
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Are you running
ncdu with sudo?– Babken Vardanyan
May 4 '16 at 10:28
Are you running
ncdu with sudo?– Babken Vardanyan
May 4 '16 at 10:28
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
And it's not a reserved block count issue? Check with
dumpe2fs.– Halfgaar
Jun 3 at 11:26
And it's not a reserved block count issue? Check with
dumpe2fs.– Halfgaar
Jun 3 at 11:26
add a comment |
1 Answer
1
active
oldest
votes
You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f560600%2fnear-100-disk-usage-df-and-du-show-very-different-results-lsof-not-the-answer%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
add a comment |
You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
add a comment |
You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
You may try running e2fsck /dev/sdxy from a live Linux to check for FS corruption. The partition must be unmounted, that's why you need to boot up a live Linux.
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
answered Dec 11 '13 at 7:12
David LakatosDavid Lakatos
17310
17310
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f560600%2fnear-100-disk-usage-df-and-du-show-very-different-results-lsof-not-the-answer%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
obO ANdh1DEYDhePCb,9ejY,kv ZjCy8LTgWiKEM6JpALAI 3o
Possible duplicate of serverfault.com/questions/57098/du-vs-df-difference
– user130370
Dec 11 '13 at 8:32
Are you running
ncduwithsudo?– Babken Vardanyan
May 4 '16 at 10:28
This is surprising. Have you finally pinpointed the cause? Or at least some hint? What happened after that?
– Stéphane Gourichon
Mar 19 '17 at 16:07
And it's not a reserved block count issue? Check with
dumpe2fs.– Halfgaar
Jun 3 at 11:26