IntermediateScenario
10 min
du and df Show Different Disk Usage
LinuxStorageTroubleshooting
Advertisement
Interview Question
On a Linux production node, `df -h` reports the filesystem nearly full, but `du -sh /` shows far less used space. How do you reconcile the discrepancy and free space safely?
Key Points to Cover
- Explain reasons: deleted-but-open files, different mount points, reserved blocks, snapshots
- Find open-but-unlinked files via lsof /proc/*/fd and release by restarting offending processes or truncating
- Check bind mounts, hidden mount points, and large directories excluded by du path
- Inspect reserved space (ext* reserved blocks) and inode exhaustion
- Add monitoring/alerts to catch leak patterns early
Evaluation Rubric
Identifies key root causes of du/df mismatch35% weight
Uses correct commands (lsof, lsns, mount) to detect culprits25% weight
Frees space safely without data loss20% weight
Suggests monitoring/prevention20% weight
Hints
- 💡Deleted log files still held open by a process are common.
Common Pitfalls to Avoid
- ⚠️Only running `du -sh /` and not investigating other mount points.
- ⚠️Attempting to delete files directly from `lsof` output without verifying they are indeed deleted-but-open.
- ⚠️Restarting critical production services without proper planning or maintenance windows.
- ⚠️Confusing reserved blocks with actual file data consumption.
- ⚠️Not considering snapshot usage as a potential space consumer.
Potential Follow-up Questions
- ❓How do you avoid logrotate issues?
- ❓How to detect inode exhaustion?
Advertisement