du and df discrepancy

[Eric Anderson]

Paul Kupfer wrote:
> 
> I am seeing a very odd problem on a FreeBSD 6.1-PRERELEASE #0 mail 
> server we have.  We originally had a separate scsi device mounted as 
> /var/mail (note this was underneath the mountpoint for /var).  We 
> reached a point where space on /var was running out, and running a df on 
> that volume would show that there was only 160M out of 5.8G available 
> (and 5.2G used).
> 
> So I ran "du -hc /var" to see where I could remove some old files.  du 
> output shows the total of /var to be 311M, which is vastly different 
> than what du tells me.  I thought that this was perhaps a result of the 
> way we had things mounted, and so I unmount the /var/mail device and 
> remounted it as /mail, then put a symlink from /mail to /var/mail, still 
> no dice, same results.
> 
> I have not rebooted the machine yet (was hoping I wouldn't have to  
> since it is a mail server).  Is it possible that the inode tables are 
> "out of whack" since changing these mountpoints, perhaps an fsck?  
> Anyone ever seen anything like this before?
> 
> Any help would be greatly appreciated.


My guess is that you run apache, and the log file got huge, rotated out, 
but apache still has it open.  You could install lsof possibly and see 
what files it has open, and it will show you their size also. 
Restarting apache should also clear it.

Eric