df and du commands show different disk usage?

When you delete a file that is being held "open" by a process what actually happens is the file's name is deleted but not its inode (and its data). df sees what is happening at filesystem level whereas du sees what is happening at file/directory level. If the filename is gone du doesn't see it in the directory any longer. However since the inode is still in use df sees that the filesystem is still using the space.

You most probably know that you can remove a file that still in use by some application and for this application it remains available. It because file descriptor in /proc/ filesystem is held open

SOLUTION - Solution is very simple for this issue

Just run this command from root user

lsof | grep '(deleted)'

It will show the output like this

java      24485 31103  centos   14w      REG              202,1           0   25520518 /opt/apache-tomcat-7.0.62/logs/catalina.2015-12-24.log (deleted)
java      24485 31103  centos   15w      REG              202,1           0   25520519 /opt/apache-tomcat-7.0.62/logs/localhost.2015-12-24.log (deleted)
java      24485 31103  centos   16w      REG              202,1           0   25520521 /opt/apache-tomcat-7.0.62/logs/manager.2015-12-24.log (deleted)
java      24485 31103  centos   17w      REG              202,1           0   25520527 /opt/apache-tomcat-7.0.62/logs/host-manager.2015-12-24.log (deleted)
java      24485 31103  centos   42w      REG              202,1 43935147690   25520530 /opt/apache-tomcat-7.0.62/logs/catalina.out.2015-12-24 (deleted)
java      24485 31103  centos   43w      REG              202,1 43935147690   25520530 /opt/apache-tomcat-7.0.62/logs/catalina.out.2015-12-24 (deleted)
java      24485 31103  centos   99w      REG              202,1   769125049   25520517 /opt/apache-tomcat-7.0.62/logs/localhost_access_log.2016-01-21.txt (deleted)



Just check the application & kill it or stop/start it (In above case I need to restart or kill Apache Tomcat to get back my lost space)