linux - Difference in free disk space - ncdu and df

I've noticed that there is a huge difference in free disk space for root by using "ncdu" or "df" for me:

df -Th:

    dev              devtmpfs  7,8G       0  7,8G    0% /dev
    run              tmpfs     7,8G    1,4M  7,8G    1% /run
    /dev/nvme0n1p2   ext4       25G     19G  4,3G   82% /
    tmpfs            tmpfs     7,8G     77M  7,7G    1% /dev/shm
    tmpfs            tmpfs     7,8G       0  7,8G    0% /sys/fs/cgroup
    tmpfs            tmpfs     7,8G     50M  7,7G    1% /tmp
    /dev/loop1       squashfs  4,3M    4,3M     0  100% /var/lib/snapd/snap/ngrok/11
    /dev/loop0       squashfs   91M     91M     0  100% /var/lib/snapd/snap/core/6405
    /dev/nvme0n1p1   vfat      246M     56M  191M   23% /boot
    /dev/mapper/home ext4      428G     52G  354G   13% /home
    tmpfs            tmpfs     1,6G     20K  1,6G    1% /run/user/

ncdu

10,5 GiB [##        ] /usr
 3,5 GiB [          ] /var
72,0 MiB [          ] /opt
55,1 MiB [          ] /boot
45,9 MiB [          ] /tmp

"ndcu" shows around 5.5gb more free space for root compared to "df". Am I missing something or why the big difference? Thanks in advance!

Answer

Possible scenario

There are various other filesystems mounted under various mountpoints which are (naturally) somewhere deeper under /. If the root filesystem contains files in those places, df will still "count" them (because it queries the filesystem itself) but du won't (because it scans the available tree).

---

Example

Just after / is mounted, /home contains 4 GB of data. Then another filesystem gets mounted at /home, it contains 52 GB of data. In this case:

• The root filesystem just reports its own usage to df, this includes those 4 GB.


• ncdu scans the directory tree. In /home it can see 52 GB from the other filesystem; ncdu -x skips this entirely. In both cases you ignore /home anyway, because you know it's another filesystem.

In the result, after you add up all the relevant lines from ncdu, you will still miss those 4 GB.

---

Confirmation

Bind mount the same filesystem elsewhere (note -B doesn't mount submounts):

sudo mount -B / /mnt/elsewhere

Analyze what ncdu /mnt/elsewhere yields. Is there data in /mnt/elsewhere/home, /mnt/elsewhere/boot or in another directory that normally is covered by a submount? Can it explain the discrepancy?

Before you remove anything, make sure you know what you're doing. Finally run sudo umount /mnt/elsewhere to unmount.