6 Replies Latest reply: Feb 11, 2010 12:16 PM by 807567 RSS

    df and du output is different in solaris9

    807567
      Hi Gurus,

      One of our sun server solaris 9 OS I got root filesystem critical .
      when I check df and du shows different usage output, tried restarting the service and also rebooting the server but still problem exist.
      Can anybody help how I can resolve this issue bcoz this our impt and production server. Your help in this highly helpful.
      Let me know if you need more info
        • 1. Re: df and du output is different in solaris9
          user4994457
          Care to show any actual output?

          df -k /
          du -sdk /
          du -dk / | sort -n | tail -15

          --
          Darren
          • 2. Re: df and du output is different in solaris9
            807567
            Please find the output

            # df -k /
            Filesystem kbytes used avail capacity Mounted on
            /dev/vx/dsk/bootdg/rootvol
            10086988 8955416 1030703 90% /
            # du -sdk /
            3074817

            # du -dk / | sort -n | tail -15
            147821 /opt/VRTSob
            155185 /opt/SUNWspro/contrib
            158062 /root
            208309 /var/opt
            226707 /var/sadm/pkg
            254401 /opt/sun_docs/C/solaris_9
            254402 /opt/sun_docs/C
            254404 /opt/sun_docs
            279020 /var/sadm
            441676 /opt/SUNWspro/prod/lib
            566093 /opt/SUNWspro/prod
            704482 /var
            722734 /opt/SUNWspro
            2004678 /opt
            3074872
            • 3. Re: df and du output is different in solaris9
              user4994457
              The number one cause of this is a large file held open by a process. But you said you've rebooted, so that can't be it.

              The next ones down the list are filesystem corruption (you don't show any indication of that), or a hidden directory.

              Do you have any other filesystems mounted? It could be that the underlying directory contains data, but after the mount is done all of that data is hidden from 'du'.

              The two ways to examine would be to unmount the filesystem and check the disk. One of the cleanest ways to do this would be to boot with CD/DVD, mount the root filesystem and run 'du' on it. It won't have any mounts on top to interfere.

              Another way is to share the root filesystem via NFS and then mount it as a client. Other mounts on top are stripped off and you can see the files underneath.

              Finally, I'd go ahead and run a 'fsck -n' on the root filesystem just to make sure it didn't whine about something major.

              --
              Darren
              • 4. Re: df and du output is different in solaris9
                807567
                It's normal.
                df reads superblock information, while du reads file descriports. So, if some application open some file, and then you or anoser process delete it. Superblock won't be updated until every process drop file. You can easy test that feature.
                mkfile 5mb /export/home/testfile
                vi /export/home/testfile &
                rm /export/home/testfile
                du -sk /export/home/
                df -k /export/home/
                kill %1
                du -sk /export/home/
                df -k /export/home/
                • 5. Re: df and du output is different in solaris9
                  user4994457
                  pvoropaev wrote:
                  It's normal.
                  df reads superblock information, while du reads file descriports. So, if some application open some file, and then you or anoser process delete it.
                  That is true until the file is closed. Since the OP mentioned that he has rebooted, all the files must have been closed.

                  --
                  Darren
                  • 6. Re: df and du output is different in solaris9
                    807567
                    guess OP has some starting scripts, like logrotate, maybe sort of replication.
                    There is linux util lsof you can download it from sunfreeware. It helps you with determitaion which process hold deleted file.
                    /usr/sbin/lsof +d /mnt/cdrom
                    
                    COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
                    
                    mc 1547 kos cwd DIR 11,0 2048 53248 /mnt/cdrom
                    
                    bash 1556 kos cwd DIR 11,0 2048 53248 /mnt/cdrom