From owner-freebsd-questions Fri Nov 14 17:30:50 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id RAA19683 for questions-outgoing; Fri, 14 Nov 1997 17:30:50 -0800 (PST) (envelope-from owner-freebsd-questions) Received: from gdi.uoregon.edu (gdi.uoregon.edu [128.223.170.30]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id RAA19665 for ; Fri, 14 Nov 1997 17:30:43 -0800 (PST) (envelope-from dwhite@gdi.uoregon.edu) Received: from localhost (dwhite@localhost) by gdi.uoregon.edu (8.8.7/8.8.7) with SMTP id RAA04542; Fri, 14 Nov 1997 17:30:10 -0800 (PST) (envelope-from dwhite@gdi.uoregon.edu) Date: Fri, 14 Nov 1997 17:30:10 -0800 (PST) From: Doug White Reply-To: Doug White To: Charles Owens cc: Craig Johnston , questions list FreeBSD Subject: Re: full file system: df and du disagree - why? In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk On Fri, 14 Nov 1997, Charles Owens wrote: > > > A 'du -ks /var' showed that only 11 out of 60 megs were in use, so I > > > _knew_ that there was plenty of free space. But, df didn't think so, and > > > the kernel apparantly didn't think so either, as writes to /var still > > > produced a filesystem full error. > > > > Some process has a file that has been rm'ed open, likely. The file is not > > actually deleted until the last process that has it open closes it. Du will > > report the space as unused, df will report correctly. > > Thanks! Could you define "rm'd open" ? Under UNIX, files have a `link count' associated with them. WHen you create a file on a filesystem, it gets one link to the FS. When a program opens a file, the link count is incremented. When a program closes a file or you use the rm(1) command, the link count is reduced by one. When the link count reaches 0, the index node (inode) is cleared, the disk's block free list is updated and the file is forgotten. The problem you may be seeing is that although you deleted a file, some program still has the file open. Even though the filesystem's link is gone, the link count is still >0, so the inode continues to exist, and so df(1) will count it (since it exists in the used block list) even though du(1) can't see it since it can't see it's directory entry. Check out the fs(5) and friends man page for a little more detail. Hopefully I haven't obfusciated this too badly. Doug White | University of Oregon Internet: dwhite@resnet.uoregon.edu | Residence Networking Assistant http://gladstone.uoregon.edu/~dwhite | Computer Science Major