Q: The `du -sh /` and `df -h` commands show significantly different disk usage values. `df` shows 90% used, but `du` reports only 60% of the disk in use. What explains this discrepancy?
The du and df commands measure disk usage differently:
#Linux #Allow user 'deploy' to restart nginx and read syslog only #L2 #SRE #Systems #Troubleshooting
🎙️ Candidate Opening & Architectural Context
""Never reboot a server blindly; always capture top process telemetry, lsof descriptors, and thread dumps first. The interviewer is testing: Understanding of deleted-but-open files, reserved blocks, filesystem internals.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
The du and df commands measure disk usage differently:
duwalks the directory tree and sums up the sizes of files it can see (existing directory entries).dfqueries the filesystem's superblock, which tracks total allocated vs. free blocks.- Deleted files still held open by processes: When a file is deleted (
rm) but a process still has it open,ducan't see it (directory entry is gone), butdfstill counts the blocks as used. Fix:lsof +L1finds files with zero links (deleted but open). Restart the process or truncate via/proc/./fd/
2️⃣
Remediation & Permanent Safeguards
Common causes of discrepancy:
- Reserved blocks: ext4 reserves 5% of the partition for root by default.
dfaccounts for these reserved blocks;dudoesn't know about them. Check withtune2fs -l /dev/sda1 | grep "Reserved block count". Reduce if needed:tune2fs -m 1 /dev/sda1(sets reserved to 1%). - Filesystem journal: The ext4 journal consumes space visible to
dfbut notdu.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: du walks the directory tree and sums up the sizes of files it can see (existing directory entries).."
⚡ 60-Second Elevator Pitch Talking Points
- du walks the directory tree and sums up the sizes of files it can see (existing directory entries).
- df queries the filesystem's superblock, which tracks total allocated vs. free blocks.
- Deleted files still held open by processes: When a file is deleted (rm) but a process still has i...
Advertisement