Normally, df and du will report with closest usage on a specific file system. But there might be some open file was opened and deleted by other process but it does not exist in the directory structure.

 

This article are for specific Linux O/S 

 

As an example: we have

# df-h
Filesystem            Size  Used AvailUse% Mounted on

/dev/vx/dsk/datadg/apps
                     503G  278G  211G  57%/apps

# du -sh /apps
87G     /apps

To see what file was meant to delete and still holding on by the process id , please run

#lsof /apps | grep deleted

oracle   5332oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5334oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5336oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5338oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5340oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5342oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5344oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5346oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)
oracle   5348oracle    7u   REG 199,65533         0 18418/apps/VRT/dbs/lkinstorcl (deleted)

You can use the following commands to get all pid

#PIDLIST=`lsof /apps | grep delete | awk ' { print $2 }'`
#ps -p $PIDLIST
 PID TTY      STAT   TIMECOMMAND
5332 ?        Ss     1:25ora_pmon_orcl
5334 ?        Ss     0:46ora_psp0_orcl
5336 ?        Ss     0:04ora_mman_orcl
5338 ?        Ss     2:55ora_dbw0_orcl
5340 ?        Ss     2:01ora_lgwr_orcl
5342 ?        Ss     6:00ora_ckpt_orcl
5344 ?        Ss     9:19ora_smon_orcl
5346 ?        Ss     0:01ora_reco_orcl
5348 ?        Ss    11:54ora_cjq0_orcl
5350 ?        Ss     8:57ora_mmon_orcl
5352 ?        Ss     2:24ora_mmnl_orcl
5354 ?        Ss     0:00ora_d000_orcl
5356 ?        Ss     0:00ora_s000_orcl
5362 ?        Ss     0:00ora_qmnc_orcl
5467 ?        Ss     0:00ora_q000_orcl
5475 ?        Ss     4:21ora_q001_orcl
12952 ?        Ss     0:00ora_j000_orcl

Normally, unmount and remount the file system will flush the inode structure and will provide the correct usage.

 

In case if you cannot unmount the file system,  you can kill these processes with customer's consent , this will help remove all the open files and "df" and "du" will now show the correct usage.