I have an even more interesting case of ls disagreeing with du:

Code:

[server1-/var/crash]# ls -lh 10.1.1.100-2009-01-05-14:01
total 1018M
-rw-------  1 netdump netdump 332K Jan  5 14:56 log
-rw-------  1 netdump netdump  16G Jan  5 14:52 vmcore

[server1-/var/crash]# du -h 10.1.1.100-2009-01-05-14:01/*
336K    10.1.1.100-2009-01-05-14:01/log
1017M   10.1.1.100-2009-01-05-14:01/vmcore

These files were created by netdump on linux. The filesystem type is ext3.

So it basically looks like I have a 16GB file that only occupied about 1GB of disk space.

Is vmcore a so-called "sparse file"?

I've only seen something similar once before, those were vmlog files created by vmware ESX host on an NFS mount (du would report 0 but ls would show a 1GB file).