du results on filesystem inconsistent with df

What explains the discrepancy in usage (82 GB vs 13 GB) that I see below?

  • Using df:

    $ df -h /
    Filesystem            Size  Used Avail Use% Mounted on
    /dev/sda2              96G   82G  9.9G  90% /
    
  • Using du:

    $ sudo du -cshx /
    13G     /
    13G     total
    

-x option is a false friend as its purpose is to skip things. That option never gives you the complete picture.

To get a complete listing, use bind mounts and then du, ncdu, xdiskusage, baobab or whatever you wish on the bound directory without skip options:

mkdir /mnt/root
mount --bind / /mnt/root
ncdu /mnt/root

Then you might discover you have lots of stuff in /mnt/backup (because it wasn’t mounted when the backup task ran), or a giant file in /dev (result of a dd if=/dev/zero of=/dev/sdx when no /dev/sdx existed and no tmpfs was mounted in /dev).

It could also be a deleted file still used by a process, but people don’t usually ask about it as it’s gone after reboot. It could also be a filesystem inconsistency, but that too would be gone after reboot (if it forces fsck in the process).

Answered By: frostschutz