discrepancies in disk usage between df and du

[Fernan Aguero]

Hi,

I have a box (7.2-STABLE, amd64) that is currently showing some disk
usage problems. It all started with apache generating huge logs from
one of the mod_perl applications that is undergoing testing. So the
/var partition was getting full.

We removed all logs that were causing the problem, but even though du
shows some 700 Mb of usage, df shows that the disk is full (-1.5 Gb):

[fernan at omega ~] sudo du -hc -d1 /var/
Password:
2.0K	/var/.snap
423M	/var/account
6.0K	/var/at
2.0K	/var/audit
 18K	/var/backups
4.0K	/var/crash
6.0K	/var/cron
 53M	/var/db
2.0K	/var/empty
2.0K	/var/heimdal
219M	/var/log
 14M	/var/mail
4.0K	/var/msgs
 48K	/var/named
2.0K	/var/preserve
 44K	/var/run
2.0K	/var/rwho
 16K	/var/spool
 76K	/var/tmp
 24K	/var/yp
2.0K	/var/games
710M	/var/
710M	total

[fernan at omega ~] df -h
Filesystem                Size    Used   Avail Capacity  Mounted on
/dev/mirror/gm0s1f         18G     18G   -1.5G   109%    /var

I've been googling around, and I understand why df and du might be
reporting disk usage differently. However, I can't solve this issue
and reclaim unused disk space ... applications (apache, mod_perl) are
prevented to write to /var and this is causing us problems.

We've already tried rebooting the box, restarting the syslog,
newsyslog daemons, to no avail. df keeps showing >100% disk usage
(-1.5 Gb of remaining disk space) in all cases. We've even rebooted
the box with all apache instances turned off in rc.conf ... i.e.
without any but the most basic services running (sshd) ...

This box is essentially a web server, no other services are being run.

Any suggestions as to what to try next?

Thanks in advance,

-- 
fernan