今天碰到一个诡异的问题，du和df看到的数据不一致。
df显示/var已经使用了100多G，但是du看到只有10多G。之前也碰到过这样的问题，应该是程序占用了磁盘空间没有释放，一般重启机器或者重启程序（如果你知道是哪个的话）就好了。
为什么df和du的结果不一样。大家可以看下面这段英文（如果看得懂的话），或者访问http://www.linuxfly.org/post/575/ .
Document Id: 26928Synopsis: du and df Differences (originally published 8/91)
Update date: 2001-05-13Description: du and df Differences
This article explains how reporting disk usage du and reporting free disk space
on file systems df may show different numbers.
du
–
The du user command gives the number of kilobytes contained in all files and,
recursively, directories within each specified directory or file (filename).
If filename is missing, `.’ (the current directory) is used. A file which
has multiple links to it is only counted once.
EXAMPLE:
system % du
5 ./jokes
33 ./squash
44 ./tech.papers/lpr.document
217 ./tech.papers/new.manager
401 ./tech.papers
144 ./memos
80 ./letters
388 ./window
93 ./messages
15 ./useful.news
1211 .
Note that the last number, 1211 is the grand total (in kilobytes) for the
directory.
df
–
The df user command displays the following information:
amount of disk space occupied by currently mounted file systems
the amount of used and available space
how much of the file system’s total capacity has been used
Used without arguments, df reports on all mounted file systems.
EXAMPLE:
system % df
Filesystem kbytes used avail capacity Mounted on
/dev/ip0a 7445 4714 1986 70% /
/dev/ip0g 42277 35291 2758 93% /usr
Note: used plus avail is less than the amount of space in the file system
(kilobytes) because the system reserves a fraction of the space in the file
system to allow its allocation routines to work well. The amount reserved is
typically about 10%. (This may be adjusted using the tunefs command. Refer to
the man pages on tunefs(8) for more information.) When all the space on a file
system, except for this reserve, is in use, only the super-user can allocate
new files and data blocks to existing files. This, however, may cause the file
system to be over allocated. When a file system is over allocated in this way,
df may report that the file system is more than 100% utilized.
If arguments to df are disk partitions (for example, /dev/ip0as or path names),
df produces a report on the file system containing the named file. Thus, df
shows the amount of space on the file system containing the current directory.
Problem Definition
This section gives the technical explanation of why du and df sometimes report
different totals of disk space usage.
When a program that is running in the background writes to a file while the
process is running, the file to which this process is writing is deleted.
Running df and du shows a discrepancy in the amount of disk space usage. The
df command shows a higher value.
Explanation Summary
When you open a file, you get a pointer. Subsequent writes to this file
references this file pointer. The write call does not check to see if the file
is there or not. It just writes to the specified number of characters starting
at a predetermined location. Regardless of whether the file exist or not, disk
blocks are used by the write operation.
The df command reports the number of disk blocks used while du goes through the
file structure and and reports the number of blocks used by each directory. As
far as du is concerned, the file used by the process does not exist, so it does
not report blocks used by this phantom file. But df keeps track of disk blocks
used, and it reports the blocks used by this phantom file.
因为我这台机器是线上系统，不能重启。哎，只好继续找原因了。幸好有lsof这个神器，很快就定位到原因了。先上图：
分析一下这条命令：losf |grep var|grp deleted
首先lsof这条命令就不讲了，自己baidu、google吧。因为要分析var分区，所以grep占用var分区的文件。然后我怀疑是文件在被程序调用时被人给删了，导致出现了现在的情况，所以grep ”deleted“字段。图中倒数第3列是占用的磁盘字节数。
解决方法：
找到进程号，直接kill掉就ok了。