weird different output of "df" and "du"

[yyghp]

This morning, I found that the "emagent" ( one of the oracle 10g services, very buggy one !!! ) was leaking the disk space, by using "df":

# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vg00/lv01 20158332 8173420 10960912 43% /
/dev/cciss/c0d0p1 98747 48786 44862 53% /boot
/dev/vg00/lv02 1007896 248276 708420 26% /home
none 1912528 0 1912528 0% /dev/shm
/dev/vg00/lv03 4031680 32920 3793960 1% /tmp
/dev/vg00/lv04 20158332 2969416 16164916 16% /u01

The "Used" number of mount point "/u01" was getting increase about 2MB/second !
Within 20mins:

# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vg00/lv01 20158332 8173276 10961056 43% /
/dev/cciss/c0d0p1 98747 48786 44862 53% /boot
/dev/vg00/lv02 1007896 447404 509292 47% /home
none 1912528 0 1912528 0% /dev/shm
/dev/vg00/lv03 4031680 32920 3793960 1% /tmp
/dev/vg00/lv04 20158332 9476816 9657516 50% /u01

But when I shutdown the "emagent", "/u01" went back to original size immediately ! It seemed one temporary file ( a big one ) was removed...

I tried to find out such temporary file when "/u01" was leaking, but I couldn't successfully locate this file :(

One thing very weird was that the output of "du" ( "du -ks /u01" ) was always showing me the same:
# du -ks /u01
2937064 /u01
Although the output of "df" showed the "/u01" decreased 2MB/second !
I thought the output of "du" and "df" should show a similar number for the same mount point, why there is such difference in this case ! "du" had 2.9GB on /u01 while "df" showed 9.4GB on /u01 !

Thanks !

[Steven E. Protter]

df and du calcuate space differently.

Sometimes when a process has reserved disk space and not used it, the disk space figures will vary.

If the emagent service was shut down normally, you'd find the figures would balance out.

If a process is killed while disk is allocated for use but not used, the figures will sometimes disagree. Usually restarting the server will clear the issue and cause the figures to agree again.

SEP

[Fred Ruffet · Accepted solution]

This is probably due to a pre-allocation.

You can see such a behaviour on Oracle temp file. You tell Oracle to use a 100MB temporary file, but using du you see it very small. Using df it's the size you asked. It's because Oracle pre-allocates your 100MB but do not write a 100MB file. It only uses what it needs.

It doesn't mean you agent is not buggy and that it doesn't waste space (pre-allocated space is considered as used and can not be allocate for anyone else) but it means that you will not be able to see it through du.

Regards,

Fred

[Michael Williams_6]

If you want to know what file emagent is creating, then run it as a unique user and then do lsof | grep {user}. This should list all files open by that user and you can then track down which one it is.

There's probably a better way to do this with lsof, so use the man page!