Understanding Results from df and du commands

Good day every one.
When a use df -h comand on my read hat linux server i get something like this:

/dev/mapper/Vg02-Lv19 30G 29G 145M 100% /app

Then when i do du -sh /app/
i get
12G /app/
For me it is meaning that only 12G was used on /app partition.
How can i see where are being used other 18G?

best Regards
Gege

They are probably in deleted files.

Naively deleting busy or open files will cause them to not be listed, yet still stored on disk; they will remain stored until whatever is holding them open closes them or quits.

There's a difference between the file size in bytes as displayed by e.g. ls , and the space allocated on disk, today usually multiples of 4k. Use ls -s to get a feeling for the two, and the difference. But, to explain such a huge discrepancy (12 GB as opposed to 18 GB), this would not normally suffice, except if you had a really really large number of really small files.

Corona668's suspicion is a very good candidate; use lsof /app and search for "(deleted)" entries:

firefox    2287 cxxr   36r   REG    8,8     6184 374670 .local/share/gvfs-metadata/root (deleted)
1 Like

It seems you have "sparse" files in your filesystem. Those files shows significantly different sizes in [du -sh filename] & [ ls -lh filename ] outputs.

Start with finding files which are more than 1 MB and do a "ls -lh" and "du -sh" on those files. If you find any file which shows 1 MB in one output and 1 GB in another output - there is the culprit. :slight_smile:

Hope this helps. Read more on sparse files on wikipedia or some good website and that will give you more insight about these type of files.

A sparse file could use less disk than its length, but never more.

Yes, sparse files would show the reverse effect. That's why I did not mention them above.

Hi RudiC
The lsof command is not working for me
.
[oracle@zambezi udump]$ lsof /app
-bash: lsof: command not found
[oracle@zambezi udump]$

regards
Gege

Well then, you might wish to install it.

Hi
but it seem that it is already installed, as I can see by using the following command:
rpm -qa|grep lsof, i get
lsof-4.72-1.1

Please advise.
Regards

Hey, come on, be reasonable, and be creative. What about whereis lsof ? What about type lsof ? What about find $PATH -name lsof ?