Answers: <ol>
  <li><p>Sadly, <code>df -h</code> has right. They work very differently: <code>df -h</code> queries and answers the count of the allocated blocks on the partition, while <code>du -sh</code> recursively travlers a directory tree and summarizes the size of the files found.</p>
  </li>
  <li><p>You did not ask, but here you have likely yet another question: how can 0 byte left if 19GB is used on a 20GB hard disk. Answer is that filesystems, including ext4, tend to reserve the last percents (5%) for root-only, i.e. that can be allocated only by root processes. You can turn off the feature by a <code>tune2fs -m 0 /dev/sda1</code> command. That is permanent and does not need an unmount or reboot. After that, you will see the rest of your last about 1GB.</p>
  </li>
  <li><p><code>du -sh *</code> is completely incompetent for this task, on multiple reasons. The first reason is that it measures the size of the files allocated in a directory. But, for example, /proc, /run, /dev/shm are mounted filesystems, also they are reachable from the /, where you have executed <code>du -sh *</code>.</p>
  </li>
  <li><p>Things are yet more bad if anything is under /proc, for example some bad software or funny co-sysadm ;-) placed there a 10GB big file with zeros, that would still count as allocated blocks, but it would not be visible for your <code>df</code>.</p>
  </li>
  <li><p>Things are also bad that a file can be deleted under Linux even if it is open. This is one of the reasons, why Linux does not need to reboot every tuesday. However, a deleted file only disappears from the directory listing, thus <code>df</code> won't see it any more, but its blocks won't be deallocated. Its blocks will be deallocated only if the last process is closing it. <strong>That is the most likely cause of your huge difference.</strong></p>
  </li>
  <li><p><code>df -h *</code> shows only the non-hidden root directories, i.e. if you have a directory <code>/.wastebasket</code>, full with 14GB crap, then your command won't see also this. A <code>df -h * .*</code> would show also these hidden files/directories.</p>
  </li>
  <li><p>You can check the list of the deleted files by the <code>lsof</code> command. If is a very useful tool, it shows all opened files of all processes, including the deleted ones. I suggest to once read its documentation. Well, it is big, I was lazy for that until now :-) rather I use an <code>lsof|grep -i deleted</code>.</p>
  </li>
  <li><p>You can actually do some like you try to reach with the <code>du -sh *</code>, but it requires more steps. First, mount your root partition again into a temporary mount point: <code>mount /dev/sda1 /mnt/tmp</code> (mkdir /mnt/tmp if it does not exist yet). Then, a <code>du -ba .|sort -n -r|head -100</code> in <code>/mnt/tmp</code> will show the 100 of your largest files or directories. Trick is that this secondary mount will be &quot;mount-clean&quot;. After that, do not forget to un-mount <code>/mnt/tmp</code>.</p>
  </li>
  </ol>
  <hr />
  <p>I estimate the probability of that either <code>lsof</code>, or this <code>du -ba .</code> will solve your problem, to about 99%.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-08-26T18:54:18.487Z
Answers: Thank you, peterh! It was about deleted files held by some old processes.
Answers: MiamiBeach
Answers: CC BY-SA 4.0
Answers: 2024-08-26T19:39:42.550Z
Answers: @MiamiBeach Wonderful, in most cases you can just restart a service or that process.
Answers: peterh
Answers: CC BY-SA 4.0
Answers: 2024-08-23T16:53:25.730Z
Answers: 2024-08-23T16:53:25.730Z
Answers: peterh
Body: <p>I want to understand how much disk space I have left on my virtual machine. I am running df -h and get results. Then to doublecheck I am running du -sh * to see which folders consume the space. I am surprised to see this 2 results do not match! du -sh * gives me 5 GB disk space used. df -h tells me all 20 GB are used. Where is the truth?</p>
  <p>Please see attached screen.</p>
  <p><a href="https://i.sstatic.net/bmEZ7aIU.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/bmEZ7aIU.png" alt="enter image description here" /></a></p>
  
Tags: <linux><bash>
Title: Linux: difference between outputs of df -h and du -sh *
UserDisplayName: MiamiBeach
ThreadText: # Linux: difference between outputs of df -h and du -sh *
  
  (Asked by: username_0 on 2024-08-23)
  
  I want to understand how much disk space I have left on my virtual machine. I am running df -h and get results. Then to doublecheck I am running du -sh \* to see which folders consume the space. I am surprised to see this 2 results do not match! du -sh \* gives me 5 GB disk space used. df -h tells me all 20 GB are used. Where is the truth?
  
  Please see attached screen.
  
  [![enter image description here](https://i.sstatic.net/bmEZ7aIU.png)](https://i.sstatic.net/bmEZ7aIU.png)
  
  **Tags:** linux, bash
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-08-23. Score: 1 | Accepted answer
  
  1. Sadly, `df -h` has right. They work very differently: `df -h` queries and answers the count of the allocated blocks on the partition, while `du -sh` recursively travlers a directory tree and summarizes the size of the files found.
  2. You did not ask, but here you have likely yet another question: how can 0 byte left if 19GB is used on a 20GB hard disk. Answer is that filesystems, including ext4, tend to reserve the last percents (5%) for root-only, i.e. that can be allocated only by root processes. You can turn off the feature by a `tune2fs -m 0 /dev/sda1` command. That is permanent and does not need an unmount or reboot. After that, you will see the rest of your last about 1GB.
  3. `du -sh *` is completely incompetent for this task, on multiple reasons. The first reason is that it measures the size of the files allocated in a directory. But, for example, /proc, /run, /dev/shm are mounted filesystems, also they are reachable from the /, where you have executed `du -sh *`.
  4. Things are yet more bad if anything is under /proc, for example some bad software or funny co-sysadm ;-) placed there a 10GB big file with zeros, that would still count as allocated blocks, but it would not be visible for your `df`.
  5. Things are also bad that a file can be deleted under Linux even if it is open. This is one of the reasons, why Linux does not need to reboot every tuesday. However, a deleted file only disappears from the directory listing, thus `df` won't see it any more, but its blocks won't be deallocated. Its blocks will be deallocated only if the last process is closing it. **That is the most likely cause of your huge difference.**
  6. `df -h *` shows only the non-hidden root directories, i.e. if you have a directory `/.wastebasket`, full with 14GB crap, then your command won't see also this. A `df -h * .*` would show also these hidden files/directories.
  7. You can check the list of the deleted files by the `lsof` command. If is a very useful tool, it shows all opened files of all processes, including the deleted ones. I suggest to once read its documentation. Well, it is big, I was lazy for that until now :-) rather I use an `lsof|grep -i deleted`.
  8. You can actually do some like you try to reach with the `du -sh *`, but it requires more steps. First, mount your root partition again into a temporary mount point: `mount /dev/sda1 /mnt/tmp` (mkdir /mnt/tmp if it does not exist yet). Then, a `du -ba .|sort -n -r|head -100` in `/mnt/tmp` will show the 100 of your largest files or directories. Trick is that this secondary mount will be "mount-clean". After that, do not forget to un-mount `/mnt/tmp`.
  
  ---
  
  I estimate the probability of that either `lsof`, or this `du -ba .` will solve your problem, to about 99%.
  
  > **Comments:**
  > **username_0**: Thank you, username_1! It was about deleted files held by some old processes.  
  > **username_1**: @username_0 Wonderful, in most cases you can just restart a service or that process.  
  
  ---
  
  