`df -h /var` reports the filesystem 100% full, but `du -sh /var` accounts for only about half that space. Nothing is hidden under a mount point. What is the most likely explanation?
LPIC-1 Exam 101-500, objective 104. Devices, Linux filesystems, filesystem hierarchy standard hard
Draft — not checked yet. This question was written from the published exam objectives and cites the clause it comes from, but nobody has yet read it against that clause and signed for it.
It is kept out of search results and out of mock exams until they have. Read the source below before you take the answer as settled.
The options
Not correct df reports space in 1024-byte blocks while du reports it in 512-byte blocks.
Wrong. Both were given -h here, so both print the same human-readable units. Block-size differences shift numbers by a factor of two at most, not by half the filesystem.
Not correct du counts only files owned by the current user.
Wrong. du sums every file it can read regardless of owner. It can under-report only where it lacks directory permission, which it reports as an error.
Correct A process still holds an open file descriptor on a file that has been deleted, so its blocks are not freed yet.
Correct. Unlinking a file removes the directory entry, so du cannot see it, but the kernel keeps the blocks allocated until the last descriptor closes. `lsof +L1` lists such files; restarting the holding process releases the space.
Not correct The filesystem's reserved blocks for root have been exhausted by ordinary users.
Wrong on two counts. Reserved blocks (default 5% on ext filesystems, adjustable with tune2fs -m) are held back for root and the filesystem's own allocator, so ordinary users cannot consume them — that is what makes df report 100% for them while root still has room. And 5% cannot account for a factor-of-two gap, nor would it create any df/du disagreement, since du never counts reserved space either way.
Why
df asks the filesystem how many blocks are allocated; du walks the directory tree and adds up the files it finds. They disagree whenever blocks are allocated to something with no name: deleted-but-open files most commonly, or files hidden beneath a directory that has another filesystem mounted over it.
Where this comes from
- Cited
- LPI exam objective 104.2
- What it says
- Monitor free space and inode usage with du and df.
Practise this
Reading one question is not practice. The trainer will draw a set from objective 104 and space the ones you get wrong.