df and du do not return matching results

Any Linux, Unix, or *nix-like system

System administrators often notice that reports from df and du (which can both be used to report used disk space) do not agree with each other.  This often raises questions or concerns about the status of a file system or whether something is corrupted or malfunctioning.

Differences between df and du output cannot be taken as evidence of any problem.  Generally speaking, df is best used when information about an entire file system is wanted.  du is best used to examine a small subset of files / directories, but "du" can easily be deceived or misinformed by many common file system features. 

It is important to note the df and du are not intended to return the same answers -- not even necessarily close answers.  Each tool is very different from the other in it's design and intended use.  df asks the file system to report a summary of its space.  du tries to walk through the directory subtrees which are currently visible and add up values itself.  Anything which unexpectedly influences or interferes with this walk-through can skew the results.  In some cases, du will count something that is not really part of the file system.  In other cases, it may fail to count something which is part of the file system, but which is not visible or accessible at the moment.

Examples:

1.  Assume the root file system is being examined and it has files inside /subdir1.  There may even be further subdirectories below /subdir1, with further files present.  However, another (2nd) file system has been mounted over the top of /subdir1.  In that condition, "df /" will include the information about the space used within the root file system's original /subdir1.  In contrast, du will not be able to see that area and count the usage there, because another file system is overlaying that directory.  Depending on the du command given, du may (or may not) walk through the 2nd file system, but regardless of whether du counts the second file system or not, it will return different results than df.

2.  du won't count space still occupied by deleted files; df will.  This is especially common when an application opens a file and then the application (or something else) deletes it.  The file entry will disappear, so du can no longer find it and count it.  However, the file is still under the control of the application which has it open, and the space is not released.  This practice is often referred to as "delete on last close".  Some applications never close certain files until the application is stopped.  Large log files are common culprits, but it could be anything.

3.  On NFS client mounts, "df" will query the full file system at the NFS Server side for its entire space summary.  But "du" will only walk through the portion of the file system which is actually mounted at the client, which is often not the entire file system.

These are only a few examples.  There are likely many other scenarios and configurations where df and du cannot be expected to return the same results.  The possibilities are too numerous and elusive to reasonably explore all of them.

SUSE technical support operates on a "break-fix" model, which means:  When someone shows good evidence that something is broken or malfunctioning, SUSE technical support will work to investigate and fix it.  However, based on the nature of df and du and on past experience investigating such reports, SUSE cannot consider size differences between du and df to be evidence of any problem.  As such, SUSE tech support will not pursue explanations or elimination of such behavior.