# Filesystem pct/used not same as reported by df

**URL:** <https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 16, 2017, 11:52pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795 "2017-01-16T23:52:31Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 16, 2017, 11:52pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/1 "2017-01-16T23:52:32Z")

</div>

This is what i get in metricbeat. ( 0.29 used)

Mount point Available disk space Total disk space Used disk space Used disk space (%) Files  
/ 666,701,824 1,023,303,680 302,915,584 0.296 65,536

and this is df  
/dev/sda2 999320 295816 651076 32% /

Why the percentage and used/free is different from df? Why dont you use 29% instead of 0.29, althoug it should be 32%?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 17, 2017, 10:18am UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/2 "2017-01-17T10:18:50Z")

</div>

Are you sure this is the same disk? The values look quite different. Could you share the full metricbeat event?

If you load the index template into kibana you should see an automatic convergence to % values.

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 17, 2017, 4:31pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/3 "2017-01-17T16:31:59Z")

</div>

Yes, they are the same partition.

```auto
[root@ueb01 ~]# df /
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda2 999320 295820 651072 32% /

This is df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 976M 289M 636M 32% /

```

This is metricbeat event.

```auto
{
  "_index": "metricbeat-2017.01.17",
  "_type": "metricsets",
  "_id": "AVmtQ8fnAM59JGYqONlF",
  "_score": null,
  "_source": {
    "@timestamp": "2017-01-17T16:30:06.036Z",
    "beat": {
      "hostname": "ueb01",
      "name": "ueb01",
      "version": "5.0.0"
    },
    "fields": {
      "asset_tag": "d6b3ec11-ecd9-47e2-842a-99574ff8b3a0"
    },
    "metricset": {
      "module": "system",
      "name": "filesystem",
      "rtt": 113743
    },
    "system": {
      "filesystem": {
        "available": 666697728,
        "device_name": "/dev/sda2",
        "files": 65536,
        "free": 720384000,
        "free_files": 58914,
        "mount_point": "/",
        "total": 1023303680,
        "used": {
          "bytes": 302919680,
          "pct": 0.296
        }
      }
    },
    "type": "metricsets"
  },
  "fields": {
    "@timestamp": [
      1484670606036
    ]
  },
  "sort": [
    1484670606036
  ]
}

```

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 17, 2017, 4:33pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/4 "2017-01-17T16:33:22Z")

</div>

And in kibana dashboard i see also 0.29 there is no conversion to 29%.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 18, 2017, 7:43pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/5 "2017-01-18T19:43:21Z")

</div>

I don't see a difference in the raw values reported by Metricbeat and `df` other than that `df` is rounding the values. Make sure you account for the fact that `df` is rendering kibibytes (that's what it means by 1K-blocks) which are powers of 1024 rather than powers of 1000 (KB). And when `df` writes `M` it means mebibytes and not megabytes.

From `man df`:

> SIZE is an integer and optional unit (example: 10M is 10_1024_1024). Units are K, M, G, T, P, E, Z, Y (powers of 1024) or KB, MB, ... (powers of 1000).

```auto
    "system": {
      "filesystem": {
        "available": 666697728, = 635.812 MiB
        "device_name": "/dev/sda2",
        "files": 65536,
        "free": 720384000,
        "free_files": 58914,
        "mount_point": "/",
        "total": 1023303680, = 975.898 MiB
        "used": {
          "bytes": 302919680, = 288.887 MiB
          "pct": 0.296
        }
      }
    },

```

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [January 18, 2017, 7:46pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/6 "2017-01-18T19:46:47Z")

</div>

and how is the percentege used different 32% vs 0.296?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 18, 2017, 7:49pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/7 "2017-01-18T19:49:17Z")

</div>

I don't know. How does `df` come up with 32%?

Using it's own values:

295820 / 999320 = .2960212945 \* 100 = 29.6

Probably need to dig into the `df` [source code](https://github.com/coreutils/coreutils/blob/master/src/df.c#L1116-L1142) to answer that one.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 18, 2017, 8:20pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/8 "2017-01-18T20:20:16Z")

</div>

I think `df` is using the following calculation which is based on free space available to an unprivileged user.

% used = used / (total available to non-root = used + available)  
% used = 302919680 / ( 302919680 + 666697728) = 0.3124115527 = 31.24%

`available` definition - [https://linux.die.net/man/2/statfs](https://linux.die.net/man/2/statfs)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2017, 8:20pm UTC](https://discuss.elastic.co/t/filesystem-pct-used-not-same-as-reported-by-df/71795/9 "2017-02-15T20:20:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.