Filesystem pct/used not same as reported by df

Elastic Stack Beats
1

This is what i get in metricbeat. ( 0.29 used)

Mount point Available disk space Total disk space Used disk space Used disk space (%) Files
/ 666,701,824 1,023,303,680 302,915,584 0.296 65,536

and this is df
/dev/sda2 999320 295816 651076 32% /

Why the percentage and used/free is different from df? Why dont you use 29% instead of 0.29, althoug it should be 32%?

2

Are you sure this is the same disk? The values look quite different. Could you share the full metricbeat event?

If you load the index template into kibana you should see an automatic convergence to % values.

3

Yes, they are the same partition.

[root@ueb01 ~]# df /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/sda2         999320 295820    651072  32% /

This is df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2             976M  289M  636M  32% /

This is metricbeat event.

{
  "_index": "metricbeat-2017.01.17",
  "_type": "metricsets",
  "_id": "AVmtQ8fnAM59JGYqONlF",
  "_score": null,
  "_source": {
    "@timestamp": "2017-01-17T16:30:06.036Z",
    "beat": {
      "hostname": "ueb01",
      "name": "ueb01",
      "version": "5.0.0"
    },
    "fields": {
      "asset_tag": "d6b3ec11-ecd9-47e2-842a-99574ff8b3a0"
    },
    "metricset": {
      "module": "system",
      "name": "filesystem",
      "rtt": 113743
    },
    "system": {
      "filesystem": {
        "available": 666697728,
        "device_name": "/dev/sda2",
        "files": 65536,
        "free": 720384000,
        "free_files": 58914,
        "mount_point": "/",
        "total": 1023303680,
        "used": {
          "bytes": 302919680,
          "pct": 0.296
        }
      }
    },
    "type": "metricsets"
  },
  "fields": {
    "@timestamp": [
      1484670606036
    ]
  },
  "sort": [
    1484670606036
  ]
}
4

And in kibana dashboard i see also 0.29 there is no conversion to 29%.

5

I don't see a difference in the raw values reported by Metricbeat and df other than that df is rounding the values. Make sure you account for the fact that df is rendering kibibytes (that's what it means by 1K-blocks) which are powers of 1024 rather than powers of 1000 (KB). And when df writes M it means mebibytes and not megabytes.

From man df:

SIZE is an integer and optional unit (example: 10M is 1010241024). Units are K, M, G, T, P, E, Z, Y (powers of 1024) or KB, MB, ... (powers of 1000).

    "system": {
      "filesystem": {
        "available": 666697728,        = 635.812 MiB
        "device_name": "/dev/sda2",
        "files": 65536,
        "free": 720384000,
        "free_files": 58914,
        "mount_point": "/",
        "total": 1023303680,  = 975.898 MiB
        "used": {
          "bytes": 302919680, = 288.887 MiB
          "pct": 0.296
        }
      }
    },
6

and how is the percentege used different 32% vs 0.296?

7

I don't know. How does df come up with 32%?

Using it's own values:

295820 / 999320 = .2960212945 * 100 = 29.6

Probably need to dig into the df source code to answer that one.

8

I think df is using the following calculation which is based on free space available to an unprivileged user.

% used = used / (total available to non-root = used + available)
% used = 302919680 / ( 302919680 + 666697728) = 0.3124115527 = 31.24%

available definition - https://linux.die.net/man/2/statfs

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.