头条刷搞笑段子的时候 偶然看到某厂面试里有这么一道题
大概意思是:
服务器磁盘空间占用很大(df 命令查看),但是去每个分区查找的话,占用磁盘空间缺很小(du 命令),请问为什么呢?
今天就通过实践跟大家讲下这个问题
1、登录服务器 查看磁盘空间占用比较多,200 多 G
 $ df -lh
Filesystem Size Used Avail Use% Mounted on
  dev/sda2 259G 210G 37G 86% /
tmpfs 32G 20K 32G 1% /dev/shm
/dev/sda1 240M 34M 194M 15% /boot
/dev/sdb1 1.1T 171M 1.1T 1% /data
2、去每个分区看磁盘总空间不多,du -sh
3、怀疑是某进程写的日志文件被删了,但是进程还一直存在
  $ lsof |grep deleted
zabbix_ag   3586   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3586   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3593   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3593   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3594   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3594   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3595   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3595   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3596   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3596   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3598   zabbix    1w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
zabbix_ag   3598   zabbix    2w      REG                8,2          926    3670771 /var/log/zabbix/zabbix_agentd.log-20200326 (deleted)
docker      3627     root  txt       REG                8,2     14243454     533156 /usr/bin/docker (deleted)
salt-mini   4097     root  txt       REG                8,2         9032     526442 /usr/bin/python2.6 (deleted)
salt-mini   4097     root    0r      REG                8,2           17    5767173 /tmp/sh-thd-1585122196 (deleted)
salt-mini   4097     root    6w      REG                8,2         3442    3801977 /var/log/salt/minion-20201020 (deleted)
salt-mini   4098     root  txt       REG                8,2         9032     526442 /usr/bin/python2.6 (deleted)
salt-mini   4098     root    0r      REG                8,2           17    5767173 /tmp/sh-thd-1585122196 (deleted)
salt-mini   4098     root    6w      REG                8,2         3442    3801977 /var/log/salt/minion-20201020 (deleted)
java       94075     root    1w      REG                8,2 193473089391    2490385 /root/test1/dubbo-governance.log.100 (deleted)
java       94075     root    2w      REG                8,2 193473089391    2490385 /root/test1/dubbo-governance.log.100 (deleted)
其中第 7 列里有个 193473089391    值比较大,这列代表文件大小,单位为 B
193473089391 /(1024 * 1024 *1 024 )= 180 G
4、查进程
$ ps -ef|grep 94075
root      88886  87352  0 11:30 pts/0    00:00:00 grep 94075
root      94075      1 31  2020 ?        24-16:33:21 /usr/java/jdk1.8.0_131/bin/java -jar dubbo-admin-0.0.1-SNAPSHOT.jar
5、杀死进程
6、查看磁盘空间
$ df -lh
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       259G   30G  217G  12% /
tmpfs            32G   20K   32G   1% /dev/shm
/dev/sda1       240M   34M  194M  15% /boot
/dev/sdb1       1.1T  171M  1.1T   1% /data
磁盘空间使用了 30G,磁盘空间释放前使用 210G,释放了 180G,验证正确