bdf and du -ks

[mornet]

hello everybody
i'm running on a class L 1000 server with HPUX-11.00.
i have /home1 associed with /dev/vg01/lvol1 (the only lvol on this vg)( on a 18 Go disk)
when i do a bdf | grep home1 (or df -k | grep home1), i find
"/dev/vg01/lvol1 17776640 15912532 1864108 90% /home1"
if i understand, it's means that there is 16 Go occuped.

But when i do a du -ks /home1, the answer is :
"7272736 /home1" ie /1024 = 7 Go occuped.
why this difference ?
what the probleme ?
thanks for all for your help.

Thomas

[Marcin Wicinski]

Hi,

du result is not in bytes but in 512-byte blocks.

Later,

[mornet]

thanks, but for me the -k option for du means that the result is in Ko.

[Marcin Wicinski]

Yes, youre right, sorry.

[Santosh Nair_1]

Are there any processes running under /home1, you can check using fuser -cu /home1.

Its possible that someone has deleted file(s) that is still open by a process. Even though the file appears to be gone, until the process does a close() on the file(s), it is not released from the filesystem. Hence bdf will report the filesystem with the file(s) still there whereas du will report the the filesystem without the file (since du adds up all the files in the filesystem).

Hope this helps.

-Santosh

[Eugen Cocalea]

Hi,

Well, du -k gives the block count (total, occupied, free) in 1024-byte blocks. On the other hand, bdf gives you the number of free blocks. So, it depends on the size of the blocks on that partition, imho.

Try df -g and see what is the block size.

E.

[Marcin Wicinski]

du shows the number of currently allocated blocks and counts the blocks you've just deleted as free.
bdf has a more negative perspective and it shows the free disk space available.

The difference is here: if a still active process allocated blocks eg for a logfile that you've just deleted "bdf" counts these as still occupied. This wont change until the process closes the file ("deallocates the blocks") as it usually happens when the process terminates.

Later,

[mornet]

thanks for your answer.
with a fuser -cu /home1, i see that there is 17 process which are "working". but with ps -ef i see there is 7 process and some are the same in the fuser command.

#df -g /home1
/home1 (/dev/vg01/lvol1 ) :
8192 file system block size 4096 fragment size
4444160 total blocks 466025 total free blocks
466025 allocated free blocks 951552 total i-nodes
519798 total free i-nodes 519798 allocated free i-nodes
1073807361 file system id vxfs file system type
0x10 flags 255 file system name length
/home1 file system specific string


I think i reboot the system and see if the defunct process are again here or not, and if there is a difference.
thanks for all

[Marcin Wicinski]

Yes, if it's not a problem for you, you can reboot the machine - defunct processes will diappear ( defunct process = zombie process).

Later,

[Frank Slootweg]

Besides the already posted pointers to 'namesless' files (i.e. files without a name, accounted for by bdf but not fby du), please use the "-b" option of bdf (Display information regarding file system swapping) to make sure that file system swapping is not (part of) the cause.