UNIX for Dummies Questions & Answers

Hi everyone:
I was wondering if anyone can tell me why the size of a file listed using "du" and "ls -l" is different. Thanks in advance..

An 'ls -l' will show the size of the file in bytes. 'du' shows the size of the file in 512-byte units, rounded up to the next 512-byte unit.

Cheers,

Keith

Can anyone think of a scenario in which size reported by ls -l is less than the size reported by du.

The other way round is possible, if the file has holes, ls -l will report a size more than du (since du calculates the actual disk usage)

But I cannot understand why du reports a size more than ls -l.

For e.g:

% ls -l file12MB.pdf
-rw-r--r-- 1 vqwe 11650342 Apr 19 16:34 file12MB.pdf
% du -k file12MB.pdf
11404 file12MB.pdf

du shows file size is 11404 Kb.
ls shows file size is 11650342 bytes = 11377.2 Kb

How is this possible ?

Is it that du counts the space occupied by Indirect blocks as well ???

awaiting your response

That is pretty much the usual case. Take a McKusick style filesystem with 4k blocks and 1k fragments. I create a file with a single byte. ls says the length is 1 byte. du says the length is 2 blocks. Here is the definition of a stat structure. ls uses st_size while du uses st_blocks. (ls will report both numbers if you use "ls -ls".) The relationship between these two numbers depends on the filesystem. With most filesystems, yes, indirect blocks count. Some filesystems may have a way to preallocate data blocks to a file in advance of the need.

Btw, your second case is often called "sparse files".

I have an even more interesting case of ls disagreeing with du:

Code:

[server1-/var/crash]# ls -lh 10.1.1.100-2009-01-05-14:01
total 1018M
-rw-------  1 netdump netdump 332K Jan  5 14:56 log
-rw-------  1 netdump netdump  16G Jan  5 14:52 vmcore

[server1-/var/crash]# du -h 10.1.1.100-2009-01-05-14:01/*
336K    10.1.1.100-2009-01-05-14:01/log
1017M   10.1.1.100-2009-01-05-14:01/vmcore

These files were created by netdump on linux. The filesystem type is ext3.

So it basically looks like I have a 16GB file that only occupied about 1GB of disk space.

Is vmcore a so-called "sparse file"?

I've only seen something similar once before, those were vmlog files created by vmware ESX host on an NFS mount (du would report 0 but ls would show a 1GB file).