Strange du output

[Shibin_2]

I have a strange du output.

du -xk shows as follows ( which is correct )

(root)> du -xk / |sort -nr |head
474432 /
218416 /etc
163224 /sbin
96680 /etc/vx
92856 /etc/lp
85208 /etc/lp/interface
83256 /etc/vx/type
75256 /etc/lp/interface/model.orig
52912 /sbin/fs
52384 /lost+found

du -sk shows as follows ( wrong, I feel )

(root)> du -sk /

454852904 /

My root file system is 528MB in size.

/ (/dev/vg00/lvol3 ) : 540464 total allocated Kb
45216 free allocated Kb
495248 used allocated Kb
91 % allocation used


If you look at the du -sk output, it says, around 433GB utilized. Strange, isn't it? Why like this?

[Patrick Wallek]

>>If you look at the du -sk output, it says, around 433GB utilized. Strange, isn't it?

No, not really.

>>Why like this?

The '-s' switch tells 'du' to summarize everything within the current directory. You told it 'du -sk /' so it summarized EVERYTHING under /. This includes ALL of your mountpoints.

When you use the '-x' switch, it will look within the **current mount point only**. So when you did 'du -xk /' it ONLY looked at the / mount point and did NOT traverse down the other mount points.

[Shibin_2]

Thank you Patrick.

>> You told it 'du -sk /' so it summarized EVERYTHING under /. This includes ALL of your mountpoints.

It's still not digesting to me. Because, I have 12 x 500GB and 2 x 1TB oracle file systems in this. Both 1TB fs are 55% utilized. If it is summuarized "EVERYTHING" under /, then why it is only showing 433G ?

[Dennis Handly]

>It's still not digesting to me.

Why not use bdf, it should be more understandable if you only care about filesystems.

[Shibin_2]

Hi Dennis,

Most of the time, I use bdf only. I encounter this, when I was checking FS utilization.

Later when Patrick said, I realized, it is EVERYTHING under / . Again the question came, as I have few 1TB and 500GB FS' within this system.

Why summarize query excluding those mount points? Because of permission or something else?

[Dennis Handly]

>when I was checking FS utilization.

bdf does give you this and is faster too. But it doesn't give you subsets with directory trees.

[James R. Ferguson · Accepted solution]

Hi Shibin:

> Because, I have 12 x 500GB and 2 x 1TB oracle file systems in this. Both 1TB fs are 55% utilized. If it is summuarized "EVERYTHING" under /, then why it is only showing 433G ?

You haven't said exactly how you measure these database filesystems --- with 'ls', 'bdf', 'du' or 'df'.

Database filesystems commonly have sparse files. Thus using the file's offset size (as with 'ls') to measure the space used gives you the total file size as if the empty (sparse) disk blocks are actually filled. Thus, 'ls' tells you the ultimate size of a file at a moment in time.

Neither 'du' nor 'bdf' count the empty blocks of sparse files. Hence, comparing their values to those from 'ls' will often expose sparse files. If you use 'cp' to copy a sparse file, the empty blocks are null-padded and the difference between 'ls' and 'du' or 'bdf' vanishes when you translate the 'ls' file offset pointer to block units.

Discrepancies between 'du' and 'bdf' are usually the result of open but unlinked files. The accounting differs. That is, 'du' counts *allocated* space based on an examination of the directory of the filesystem. Since unlinked, but open files, do not have a directory entry, 'du' doesn't count their blocks. With 'bdf' or 'df', a tally of the number of *free* blocks is made from the filesystem superblock information. This free space is used to calculate (infer) the filesystem's utilization. Thus the blocks associated with unlinked, open files will not be counted in 'du' but will be with 'bdf' or 'df'.

If you wish to examine a filesystem and look for open, unlinked files using 'lsof' against the filesystem in question. You can obtain 'lsof' fromthe HP-UX Porting Centre. No reboot is required for its installation. Do:

# lsof +L1 +D /mountpoint

Look for files with an "NLINK" count of zero (0). The "SIZE/OFF" field will be the size in characters consumed. Files with a link count of zero are those that have been unlinked (removed).

Regards!

...JRF...

[Shibin_2]

Good explanation from JRF. Thanks to all.