missing 57 MB from / file system

[Gordon Acocella]

We have a machine running HPUX 10.20 with a factory-installed 82 MB "/" file
system. Both df and fsck report that 73 MB are in use, but du reports that
only 17 MB are in use.

There is no swap configured on this logical volume. I tried booting into
single-user mode and fsck still said that 73 MB are in use. The open source
lsof tool only showed two files open, namely the executable files for init and
sh.

Where is the missing 56 MB? I need additional space to install Y2K patches.
Any help would be greatly appreciated.

[Anthony Goonetilleke_1]

Are you sure you are not confusing blocks with bytes?
Do the following

du -s .
du -sk .
df .
df -k .
bdf .

you will get varying results but df -k . and bdf . should give you the same
results.

[Gordon Acocella]

No, I am looking at kilobytes. Without going into too much detail, this is
what I see:

# du -s -x -k /
17748 /

# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 83733 74889 470 99% /

Compare the "used" amount from bdf with the amount shown by du.

[Vassily Gorbounov_1]

Dear Gordon,
I've encountered such problem quite a few days ago.
I also suspected an incorrect state of filesystem, because "df /" showed that
99% is used, but
"du -ks /*" showed no such big directories in a root filesystem.
The answer is:
If you use CDE , then you have /.dt/Trash folder. And all files that you've
deleted working with desktop were moved there.
In my case my /.dt/Trash folder was approximately 60 MB.
To check it you can issue "du -sk /.[a-z,A-Z,0-9]*" command.

Best regards,
Vassily

[Gordon Acocella]

I discovered the problem at the last minute and was able to successfully apply
the Y2K pacthes.

Someone had copied a large (56 MB) file into a directory which was used as an
NFS mount point. The disk space was used, but the file was not reachable by du
or other tools which traverse the directory structure. This probably happened
at a time when the remote machine was down, since this filesystem is ordinarily
mounted all the time.

I discoverd this when I went into single user mode again and did the du from
there. The disk usage reported by du then matched that reported by fsck.