很奇怪的问题，df -h /var和du -hd0 /var的结果差别很大

flyingkisser

df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad6s1a    248M     45M    183M    20%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad6s1e    248M    3.9M    224M     2%    /tmp
/dev/ad6s1f    221G     68G    135G    34%    /usr
/dev/ad6s1d    248M    247M    -19M   109%    /var

du -hd0 /var
var
9.7M    /var

为什么/var的大小用df和du的结果不同呢？
top时发现snmpd进程的cpu使用率有点高，近8%,
于是把snmpd干掉，
df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/ad6s1a    248M     45M    183M    20%    /
devfs          1.0K    1.0K      0B   100%    /dev
/dev/ad6s1e    248M    3.9M    224M     2%    /tmp
/dev/ad6s1f    221G     68G    135G    34%    /usr
/dev/ad6s1d    248M    9.7M    218M     4%    /var
就正常了，是什么原因呢？

弥敦路九号

sorry, my IME sucks.

du and df are different.
du calculates file by file, that means, it will scan every file in the specific directory. so it is slow, most of the time.
df calculates via a smarter way, by the blocks in the block_image_zone in a filesystem, so beside the space recorgnized by du, df will also count such situations in:
1. super blocks, various zones to record the fs informations.
2. blocks which are not full, if 3K of the 4K block is taken by a file, du counts 3K in, but 4K for df.
3. a unlinked file, but still hold by some processes, like yours, you know, it only release the blocks until related processes get quit.

So, du always show you a smaller disk usage than df. but i trust df, which is even faster.

flyingkisser

yeah,that's it,thanks.

zhangweizj

怎么收藏按钮没了，看来只好回帖做记号了，讲的很明白。