Why du and df Show Different Disk Usage: Deep Dive into Linux File System Mechanics

1. Inconsistent du vs. df Results

Running df -hT and du -sh / on the same system can produce dramatically different numbers. For example, df may report only 1.7 GB used on / while du reports 244 GB.

# df -hT
Filesystem   Type   Size  Used Avail Use% Mounted on
/dev/sda2    ext4    18G  1.7G   15G  11% /
...
# du -sh / 2>/dev/null
244G    /

The discrepancy arises from how each command gathers information.

2. File Storage and Deletion Mechanics

When a file (e.g., a.txt) is created in /tmp, the kernel performs several steps:

Allocate a free inode (e.g., 2222) and mark it used in the inode map.

Add a directory entry in /tmp that points to the inode.

Find free data blocks via the block map and write the file’s data, updating the block map each time.

Store the data‑block pointers in the inode.

Deletion reverses part of this process:

Remove the inode’s data‑block pointers, making the file inaccessible.

Mark the inode as free in the inode map.

Delete the directory entry.

Mark the occupied blocks as free in the block map.

If a process still holds the file open, the data blocks remain allocated until the process releases them, even though the file is no longer visible.

3. How du Works

du

walks the directory tree and calls stat on every file (including sub‑directories) to sum their sizes. This makes it relatively slow but accurate for files that are still reachable via the filesystem namespace.

If a mounted filesystem appears under the target directory, du also counts its space.

If a file has been deleted but is still open, stat cannot find it, so du ignores its size.

Example: counting all *.img files across partitions:

# find / -type f -name "*.img" -print0 | xargs -0 du -csh
19M /boot/initramfs-2.6.32-504.el6.x86_64.img
13M /mnt/linux工具/cirros-0.3.4-x86_64-disk.img
31M total

4. How df Works

df

reads each filesystem’s superblock to obtain the total number of blocks and the number of free blocks. Because the superblock is tiny (typically 1 KB), df is very fast.

It reports only the space of the filesystem on which the path resides; mounted sub‑filesystems are not double‑counted.

When a file is deleted but still open, its data blocks remain marked as used in the block map, so the superblock still reflects them as occupied. Consequently, df includes the space of such deleted‑but‑open files.

Experiment:

# dd if=/dev/zero of=/my.iso bs=1M count=1000
# df -hT /
Filesystem   Type   Size  Used Avail Use% Mounted on
/dev/sda2    ext4    18G  2.7G   14G  17% /
# du -sh --exclude="/mnt" / 2>/dev/null
2.7G    /
# tail -f /my.iso &
# rm -rf /my.iso
# du -sh --exclude="/mnt" / 2>/dev/null
1.8G    /
# df -hT /
Filesystem   Type   Size  Used Avail Use% Mounted on
/dev/sda2    ext4    18G  2.7G   14G  17% /

After killing the tail process, df reports the expected 1.7 GB, matching du.

5. Detecting Deleted‑but‑Open Files

The lsof command can list files that are still open but have been deleted, showing their sizes and the processes that hold them.

# lsof | grep deleted
php-fpm   12597 root  txt REG 8,2 4058416 931143 /usr/sbin/php-fpm (deleted)
... 
 tail      14437 root  3r   REG 8,2 1048576000 7171 /my.iso (deleted)

Understanding these mechanisms removes the mystery behind differing du and df outputs.