⚡ ~/naveed Interview Prep
⚡ Portfolio Home ✍️ Engineering Blog Deep Dives 🎯 Interview Hub 998+ Scenarios ☸️ Kubernetes Mastery Hub 24 Modules 🎮 DevOps Arcade & Quizzes Subnet Blitz ⚡ 🗺️ DevOps Roadmaps PDFs & Guides 🤖 Morpheus Analysis AI Quant ↗ 🛠️ Developer Tools Utilities 🧪 Labs & Experiments 📄 Interactive CV & Certs 🔗 All Links & Socials ⚡ Join The Dispatch (Weekly SRE Newsletter) →
Senior DevOps / SRE [L2] Linux Allow user 'deploy' to restart nginx and read syslog only Production Scenario [L2]

Q: The `du -sh /` and `df -h` commands show significantly different disk usage values. `df` shows 90% used, but `du` reports only 60% of the disk in use. What explains this discrepancy?

The du and df commands measure disk usage differently:

#Linux #Allow user 'deploy' to restart nginx and read syslog only #L2 #SRE #Systems #Troubleshooting
🎙️ Candidate Opening & Architectural Context
""Never reboot a server blindly; always capture top process telemetry, lsof descriptors, and thread dumps first. The interviewer is testing: Understanding of deleted-but-open files, reserved blocks, filesystem internals.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement

🛠️ Production Runbook & Step-by-Step Resolution

1️⃣

Initial Diagnostics & Root Cause Analysis

The du and df commands measure disk usage differently:

  • du walks the directory tree and sums up the sizes of files it can see (existing directory entries).
  • df queries the filesystem's superblock, which tracks total allocated vs. free blocks.
  • Deleted files still held open by processes: When a file is deleted (rm) but a process still has it open, du can't see it (directory entry is gone), but df still counts the blocks as used. Fix: lsof +L1 finds files with zero links (deleted but open). Restart the process or truncate via /proc//fd/.
2️⃣

Remediation & Permanent Safeguards

Common causes of discrepancy:

  • Reserved blocks: ext4 reserves 5% of the partition for root by default. df accounts for these reserved blocks; du doesn't know about them. Check with tune2fs -l /dev/sda1 | grep "Reserved block count". Reduce if needed: tune2fs -m 1 /dev/sda1 (sets reserved to 1%).
  • Filesystem journal: The ext4 journal consumes space visible to df but not du.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: du walks the directory tree and sums up the sizes of files it can see (existing directory entries).."
⚡ 60-Second Elevator Pitch Talking Points
  • du walks the directory tree and sums up the sizes of files it can see (existing directory entries).
  • df queries the filesystem's superblock, which tracks total allocated vs. free blocks.
  • Deleted files still held open by processes: When a file is deleted (rm) but a process still has i...
Advertisement
Want more Linux scenarios?
Explore our complete collection of scenario-based Linux interview runbooks.
Browse All Linux Questions →

📚 Related Production Scenarios in Linux