This content has been marked as final. Show 6 replies
Care to show any actual output?
df -k /
du -sdk /
du -dk / | sort -n | tail -15
Please find the output
# df -k /
Filesystem kbytes used avail capacity Mounted on
10086988 8955416 1030703 90% /
# du -sdk /
# du -dk / | sort -n | tail -15
The number one cause of this is a large file held open by a process. But you said you've rebooted, so that can't be it.
The next ones down the list are filesystem corruption (you don't show any indication of that), or a hidden directory.
Do you have any other filesystems mounted? It could be that the underlying directory contains data, but after the mount is done all of that data is hidden from 'du'.
The two ways to examine would be to unmount the filesystem and check the disk. One of the cleanest ways to do this would be to boot with CD/DVD, mount the root filesystem and run 'du' on it. It won't have any mounts on top to interfere.
Another way is to share the root filesystem via NFS and then mount it as a client. Other mounts on top are stripped off and you can see the files underneath.
Finally, I'd go ahead and run a 'fsck -n' on the root filesystem just to make sure it didn't whine about something major.
df reads superblock information, while du reads file descriports. So, if some application open some file, and then you or anoser process delete it. Superblock won't be updated until every process drop file. You can easy test that feature.
mkfile 5mb /export/home/testfile vi /export/home/testfile & rm /export/home/testfile du -sk /export/home/ df -k /export/home/ kill %1 du -sk /export/home/ df -k /export/home/
pvoropaev wrote:That is true until the file is closed. Since the OP mentioned that he has rebooted, all the files must have been closed.
df reads superblock information, while du reads file descriports. So, if some application open some file, and then you or anoser process delete it.
guess OP has some starting scripts, like logrotate, maybe sort of replication.
There is linux util lsof you can download it from sunfreeware. It helps you with determitaion which process hold deleted file.
/usr/sbin/lsof +d /mnt/cdrom COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mc 1547 kos cwd DIR 11,0 2048 53248 /mnt/cdrom bash 1556 kos cwd DIR 11,0 2048 53248 /mnt/cdrom