`df -h /var` reports the filesystem 100% full, but `du -sh /var` accounts for only about half that space. Nothing is hidden under a mount point. What is the most likely explanation?
LPIC-1 Exam 101-500, objective 104. Devices, Linux filesystems, filesystem hierarchy standard hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Not correct df reports space in 1024-byte blocks while du reports it in 512-byte blocks.
Wrong. Both were given -h here, so both print the same human-readable units. Block-size differences shift numbers by a factor of two at most, not by half the filesystem.
Not correct du counts only files owned by the current user.
Wrong. du sums every file it can read regardless of owner. It can under-report only where it lacks directory permission, which it reports as an error.
Correct A process still holds an open file descriptor on a file that has been deleted, so its blocks are not freed yet.
Correct. Unlinking a file removes the directory entry, so du cannot see it, but the kernel keeps the blocks allocated until the last descriptor closes. `lsof +L1` lists such files; restarting the holding process releases the space.
Not correct The filesystem's reserved blocks for root have been exhausted by ordinary users.
Wrong on two counts. Reserved blocks (default 5% on ext filesystems, adjustable with tune2fs -m) are held back for root and the filesystem's own allocator, so ordinary users cannot consume them — that is what makes df report 100% for them while root still has room. And 5% cannot account for a factor-of-two gap, nor would it create any df/du disagreement, since du never counts reserved space either way.
Why
df asks the filesystem how many blocks are allocated; du walks the directory tree and adds up the files it finds. They disagree whenever blocks are allocated to something with no name: deleted-but-open files most commonly, or files hidden beneath a directory that has another filesystem mounted over it.
Where this comes from
- Cited
- LPI exam objective 104.2
- What it says
- Monitor free space and inode usage with du and df.
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 104 and space the ones you get wrong.
More questions on this objective
- A new disk /dev/sdb has no partition table at all. Which command writes an empty GPT partition table onto it without dropping you into an interactive editor? machine-checked
- You need the partition /dev/sdc1 on a USB stick to carry a FAT32 filesystem so that Windows machines can read and write it. Which command creates it? machine-checked
- You have just run `mkswap /dev/sdb2`. Which command makes the kernel start using that swap area immediately, without a reboot? machine-checked
- Why is it dangerous to run e2fsck against an ext4 filesystem that is currently mounted read-write? machine-checked
- On an ext4 filesystem at /dev/sda1 you want an automatic check to be forced after every 30 mounts. Which command sets that? machine-checked
- An XFS filesystem on /dev/sdb1 was damaged by a power loss and must be checked and repaired. Which command is the right tool, and what state must the filesystem be in? machine-checked
All questions on Devices, Linux filesystems, filesystem hierarchy standard