Large discrepancy in reported disk usage on USR partition

[Mel]

On Thursday 30 October 2008 01:42:32 Brendan Hart wrote:
> Hi,
>
> I have inherited some servers running various releases of FreeBSD and I am
> having some trouble with the /usr partition on one of these boxen.
>
> The problem is that there appears to be far more space used on the USR
> partition than there are actual files on the partition. The utility "df -h"
> reports 25GB used (i.e. nearly the whole partition), but "du -x /usr"
> reports only 7.6GB of files.
>
> I have reviewed the FAQ, particularly item 9.24 "The du and df commands
> show different amounts of disk space available. What is going on?".
> However, the suggested cause of the discrepancy (large files already
> unlinked but still held open by active processes), does not appear to be
> true in this case as problem is present even after rebooting into single
> user mode.
>
> #: uname -a
> FreeBSD ibisweb4spare.strategicecommerce.com.au 6.1-RELEASE FreeBSD
> 6.1-RELEASE #0: Sun May  7 04:42:56 UTC 2006
> root at opus.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP  i386
>
> #: df -h
> Filesystem          Size    Used   Avail Capacity  Mounted on
> /dev/aacd0s1a       496M    163M     293M    36%    /
> devfs               1.0K    1.0K     0B      100%   /dev
> /dev/aacd0s1e       496M    15M      441M    3%     /tmp
> /dev/aacd0s1f        28G    25G      1.2G    96%    /usr
> /dev/aacd0s1d       1.9G    429M     1.3G    24%    /var

Is this output untruncated? Is df really df or an alias to 'df -t nonfs'?

> #: du -x -h /usr
> 2.0K    /usr/.snap
>  24M    /usr/bin
>   ....
>   <snip>
>   ....
> 584M    /usr/ports
> 140K    /usr/lost+found
> 7.6G    /usr

Is it possible that nfs directory got written to /usr at some point in time? 
You would only notice this with du if the nfs directory is unmounted.

Unmount it and ls -al /usr/mountpoint should only give you an empty dir.
-- 
Mel

Problem with today's modular software: they start with the modules
    and never get to the software part.