Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

df says my /dev/sda1 filesystem is almost full:

Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/sda1              8256952   7616516    221008  98% /
none                   3803676       116   3803560   1% /dev
none                   3942504         0   3942504   0% /dev/shm
none                   3942504        64   3942440   1% /var/run
none                   3942504         0   3942504   0% /var/lock
none                   3942504         0   3942504   0% /lib/init/rw
/dev/sdb             433455904    203016 411234584   1% /mnt
/dev/sdf             104806400   9539884  95266516  10% /vol

But I don't understand what is taking so much space. When I run ncdu / I get:

    2.0GiB  /usr                                                                                                                                                 
    1.2GiB  /var
  256.9MiB  /root
  132.4MiB  /lib
   24.4MiB  /boot
   24.3MiB  /home
   12.9MiB  /tmp
    7.8MiB  /bin
    7.5MiB  /sbin
    6.5MiB  /etc
e  16.0kiB  /lost+found
e   4.0kiB  /media
e   4.0kiB  /opt
e   4.0kiB  /selinux
e   4.0kiB  /srv
>   0.0  B  /dev
>   0.0  B  /mnt
>   0.0  B  /proc
>   0.0  B  /sys
>   0.0  B  /vol
@   0.0  B   initrd.img
@   0.0  B   initrd.img.old
@   0.0  B   vmlinuz
@   0.0  B   vmlinuz.old
@   0.0  B   lib64

I there something I miss ? Where is my space gone ?

share|improve this question
Large file in the / directory? Also you are running ncdu as root? Stick a large file in a directory the user running ncdu does not have list access to and ncdu is not going to be able to find it. – ewanm89 Apr 25 '12 at 16:26
up vote 3 down vote accepted

The most likely culprit is a deleted file (or files) that are still open by a process. du only counts disk space usage in the directory tree you pass and since the file is no longer in the directory tree, it is not counted. df on the other hand counts filesystem usage which includes open file descriptors. To check running processes that have open file descriptors to deleted files, use:

lsof | grep "deleted"

Kill or restart any such processes you find (use the PID in the second column) and that should resolve the issue.

share|improve this answer
he is using ncdu, not du, though probably does the same. – ewanm89 Apr 25 '12 at 16:25
Looks like simply regular du with an ncurses wrapper. – Garrett Apr 25 '12 at 16:27
not quite, it sorts by default (du has no sort), caches so you can descend into a directory to view the largest to smallest there. It's more like a console/terminal version of kdirstat/Firelight/Baobab(Disk Usage analyzer in gnome)/windirstat without the pretty graphical map representation drawn. – ewanm89 Apr 25 '12 at 16:42
Everything else you stated is true in that it operates the same way as du in terms of knowing what files are on the filesystem. – ewanm89 Apr 25 '12 at 16:44
@Garrett Thanks, you made my day sir ! Apache had open file descriptors to many, many deleted log files.. hence the issue. Solved ! – Blacksad Apr 25 '12 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .