Katkat
Back

Explain Why du and df Report Different Disk Usage

Hudson River TradingSite Reliability Engineer · Technical Screen
MediumSite Reliability EngineerTechnical ScreenSoftware Engineering Fundamentals

Last updated

This question tests your understanding of Linux filesystem internals, specifically how kernel-level storage reporting differs from user-space directory traversal.

The Problem

You are investigating a production Linux server where the df -h command reports the root partition (/) is 98% full, but running du -sh /* yields a total size significantly smaller than the reported usage. As an SRE, explain the technical reasons for this discrepancy and provide a step-by-step methodology to identify the root cause.

Your Task

  1. Explain why these two utilities track usage differently at the kernel/filesystem level.
  2. Detail the common scenarios that cause du and df to diverge.
  3. Propose a safe command-line workflow to verify which of these scenarios is occurring on a production machine.

Key Concepts to Address

  • Inodes and metadata tracking.
  • The lifecycle of deleted files held by active processes.
  • Filesystem-specific reserved blocks (e.g., ext4's 5% reserved space).
  • Mount points and file system layering.
  • Hidden directory contents or mount overlaps.

Hints

Hint 1

Consider the difference between a process holding a file descriptor to a file that has been unlinked versus a file that still exists in the directory tree.

Hint 2

Think about what information `df` queries from the filesystem superblock versus what `du` calculates by traversing the directory structure.

Hint 3

Recall how filesystems like ext4 protect the system by reserving space for the root user to prevent catastrophic system hang-ups.

Follow-up questions

  • How would you use 'lsof' or '/proc' to identify and reclaim space from deleted but still-open files?
  • If the 'du' output matches the 'df' output but a specific directory is unexpectedly large, how do you distinguish between sparse files and actual data consumption?
  • What impact would an overlay filesystem (like Docker's storage driver) have on how disk space is calculated across multiple layers?