Linux command df shows different usage than du

There are times when the du and df commands can show different disk usage stats. The usual reason for this is that a running process still has a file that was removed open. This causes df to still report that space as used. The solution to this issue is to reload or restart that service so that it closes that file handle.

lsof is a tool that can be used to find processes holding onto files. If you do not have lsof installed, you will need to install it using your package manager. Examples of how to do this are below.

# Debian and Ubuntu
apt-get install lsof
 
# CentOS, RHEL, and Fedora
yum install lsof

Next we want to use lsof to find the process

lsof | grep deleted

If you get any output changes are it looks something like this.

httpd     32617    nobody  106w      REG        9,4 1835222944     688166 /var/log/apache/awstats_log (deleted)

In this case, the process httpd is whats holding onto an 18GB file. You can either kill that process, or issue a restart using init.d or systemctl

# systemctl systems
systemctl restart httpd
 
# Older init.d systems
service httpd restart
 
# Even older systems
/etc/init.d/httpd restart

If the process doesn't have an init script you will need to restart it another way, or as a last resort kill the process. The second column output from lsof is the process id.

kill -9 32617

Now when running df again you should now see df reporting correctly.