linux根分区找不到大文件

一、现象
1、使用df -h查看各个挂载盘的使用情况

[root@test_133 ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        1.9G     0  1.9G   0% /dev
tmpfs           1.9G     0  1.9G   0% /dev/shm
tmpfs           1.9G  460K  1.9G   1% /run
tmpfs           1.9G     0  1.9G   0% /sys/fs/cgroup
/dev/vda1        40G   24G   17G  59% /
tmpfs           373M     0  373M   0% /run/user/0
/dev/vdb1       2.5T   40M  2.5T   1% /data

# 此时可以看到根分区

2、统计查看根分区使用情况

[root@test_133 ~]# du -sh /* 2> /dev/null| sort -rh
10G	/test
2.5G	/usr
373M	/var
248M	/boot
25M	/etc
460K	/run
396K	/opt
276K	/root
44K	/data
40K	/home
0	/tmp
0	/sys
0	/srv
0	/sbin
0	/proc
0	/mnt
0	/media
0	/lib64
0	/lib
0	/dev
0	/bin

# 根据以上发现只有不到13G的使用量

3、查看杀死的进程没有释放的空间

[root@test_133 ~]# lsof -n|grep deleted
systemd-u  644                          root    8r      REG              253,1  6940392   17287366 /var/lib/sss/mc/group (deleted)
systemd-u  644                          root    9r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
auditd     709                          root    4r      REG              253,1  6940392   17287366 /var/lib/sss/mc/group (deleted)
auditd     709  710 auditd              root    4r      REG              253,1  6940392   17287366 /var/lib/sss/mc/group (deleted)
auditd     709  712 auditd              root    4r      REG              253,1  6940392   17287366 /var/lib/sss/mc/group (deleted)
lsmd       738                libstoragemgmt    4r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
polkitd    741                       polkitd    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
polkitd    741                       polkitd    4r      REG              253,1 11567160   17287434 /var/lib/sss/mc/initgroups (deleted)
polkitd    741  788 gmain            polkitd    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
polkitd    741  788 gmain            polkitd    4r      REG              253,1 11567160   17287434 /var/lib/sss/mc/initgroups (deleted)
polkitd    741  789 gdbus            polkitd    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
polkitd    741  789 gdbus            polkitd    4r      REG              253,1 11567160   17287434 /var/lib/sss/mc/initgroups (deleted)
sssd       747                          root    6r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
sssd       747                          root   16r      REG              253,1 11567160   17287434 /var/lib/sss/mc/initgroups (deleted)
mcelog     750                          root    4r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
NetworkMa  755                          root   13r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
NetworkMa  755  795 gmain               root   13r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
NetworkMa  755  796 gdbus               root   13r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
chronyd    763                        chrony    5r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
sshd       800                          root    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
tuned      801                          root    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
tuned      801 1141 tuned               root    3r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
sssd_be    818                          root   18r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)
sssd_be    818                          root   19r      REG              253,1 11567160   17287434 /var/lib/sss/mc/initgroups (deleted)
sssd_nss   890                          root   17r      REG              253,1  9253600   17287362 /var/lib/sss/mc/passwd (deleted)

根据lsof以上统计杀死进程没有释放的出来也不到100M大小；

4、还有一种情况，我们可以看到有两个盘，此时已经挂在上了/dev/vda1和/dev/vdb1；有可能/data在挂在前时就已经使用了系统盘的空间大小；但是这部分当/data挂载后是不会显现的

a、重新挂载系统盘到一个不用的目录

mount  /dev/vda1 /mnt

b、统计/mnt所占目录文件大小

[root@test_133 ~]# du -sh /mnt/*|sort -rh
10G	/mnt/test
10G	/mnt/data
2.5G	/mnt/usr
374M	/mnt/var
248M	/mnt/boot
25M	/mnt/etc
396K	/mnt/opt
276K	/mnt/root
40K	/mnt/home
0	/mnt/tmp
0	/mnt/sys
0	/mnt/srv
0	/mnt/sbin
0	/mnt/run
0	/mnt/proc
0	/mnt/mnt
0	/mnt/media
0	/mnt/lib64
0	/mnt/lib
0	/mnt/dev
0	/mnt/bin

总结：所以当我们查看到根分区统计不正确时，可以考虑是进程杀死没有删除掉，这种情况可以 使用lsof查看；另外可能在磁盘挂载目录前，目录就已经占用了一定的磁盘空间