du and df discrepancy

[Paul Kupfer]

On Wed, 17 Oct 2007, Eric Anderson wrote:

> Paul Kupfer wrote:
>> 
>> I am seeing a very odd problem on a FreeBSD 6.1-PRERELEASE #0 mail server 
>> we have.  We originally had a separate scsi device mounted as /var/mail 
>> (note this was underneath the mountpoint for /var).  We reached a point 
>> where space on /var was running out, and running a df on that volume would 
>> show that there was only 160M out of 5.8G available (and 5.2G used).
>> 
>> So I ran "du -hc /var" to see where I could remove some old files.  du 
>> output shows the total of /var to be 311M, which is vastly different than 
>> what du tells me.  I thought that this was perhaps a result of the way we 
>> had things mounted, and so I unmount the /var/mail device and remounted it 
>> as /mail, then put a symlink from /mail to /var/mail, still no dice, same 
>> results.
>> 
>> I have not rebooted the machine yet (was hoping I wouldn't have to  since 
>> it is a mail server).  Is it possible that the inode tables are "out of 
>> whack" since changing these mountpoints, perhaps an fsck?  Anyone ever seen 
>> anything like this before?
>> 
>> Any help would be greatly appreciated.
>
>
> My guess is that you run apache, and the log file got huge, rotated out, but 
> apache still has it open.  You could install lsof possibly and see what files 
> it has open, and it will show you their size also. Restarting apache should 
> also clear it.

This was right on.  I restarted apache and voila!  Thank you all for your 
help.  It appears that the inodes for these files were still locked by 
apache, see the description above.

-Paul-