Understanding the Differences in File Size Reporting: Why ls and du Show Different Results in Linux

In Linux system administration, checking file sizes is a common operation. But have you ever encountered the following confusion?

Using ls shows the file as 1GB, while du only displays 20MB? Why is there such a discrepancy? This article will help you thoroughly understand the differences between the two, from underlying principles to practical scenarios!

1. Core Differences: Logical Size vs Physical Occupation

1. ls displays logical size ls -l shows the actual byte count of the file content, which is the total amount of data written when the file was created. For example:

$ ls -lh large_file.txt
-rw-r--r-- 1 user user 1.2G Apr  8 10:00 large_file.txt

Here, 1.2G indicates the total size of the file content, regardless of whether it contains holes or zero data.

2. du displays physical occupation du -h counts the actual space occupied on the disk, which is influenced by the file system block size. For example:

$ du -h large_file.txt
20M    large_file.txt

Even if the file is only 1 byte, it will occupy at least 1 block (default 4KB) of space.

2. Three Key Reasons Explained

1. File System Block Mechanism• Block size determines the minimum unit：Linux file systems allocate space in blocks (usually 4KB). • Calculation formula：Disk usage = ceil(File size / Block size) × Block sizeFor example: A 13KB file occupies 4 blocks → 16KB of space.

2. Sparse FilesSparse files save space through “holes” technology, resulting in: • ls shows the logical total size • du only counts the actual written data blocks

# Create a 1GB sparse file (actual usage 200MB)
dd if=/dev/zero of=sparse.img bs=1M seek=1024 count=0
ls -lh sparse.img  # Shows 1.0G
du -h sparse.img   # Shows 200M

3. Directory Statistics Rules• ls only displays the size of directory metadata (usually 4KB) • du recursively counts the sizes of all files within the directory

$ mkdir test_dir
$ touch test_dir/file{1..100}  # Create 100 empty files
$ ls -ld test_dir            # Shows 4.0K
$ du -sh test_dir            # Shows about 400K (100 files × 4KB block)

Please open in the WeChat client

3. Practical Scenario Analysis

Scenario 1: Abnormal Growth of Log Files

# Discover log file shows 10GB, but disk space only occupies 2GB
ls -lh app.log      # 10G
du -h app.log       # 2G
# Reason: Log file was cleared but the process has not released it (service restart needed)
lsof | grep deleted  # Check for deleted but still occupied files

Scenario 2: Size Discrepancy in Backup Files

# Original file 10GB, compressed to generate backup.tar.gz
ls -lh backup.tar.gz  # Shows 9.8G
du -h backup.tar.gz   # Shows 2.1G (compression + block allocation)

4. Advanced Techniques

1. View Actual Disk Usage

# Count total size of directory (including subdirectories)
du -sh /var/log
# Sort by size (quickly locate large files)
du -ah / | sort -rh | head -n 20

2. Handle Sparse Files

# Copy while preserving sparse characteristics
cp --sparse=always large.img backup.img

3. Permission Issue Troubleshooting

# No permission files causing abnormal statistics
sudo du -sh /protected_dir

5. Summary Comparison Table

Feature	ls Command	du Command
Statistical Object	File logical size	Disk physical space occupied
Unit	Bytes (can be converted to human-readable format)	Block size (default 4KB)
Directory Handling	Only shows directory metadata size	Recursively counts all subfiles and directories
Sparse Files	Shows total size	Shows actual occupied space

Operational Tips：• Use du for daily monitoring to understand real storage consumption • Use ls during file transfers to confirm content integrity • When suspecting space leaks, combine with lsof for troubleshooting

Next time you encounter discrepancies in file sizes, you will be able to quickly identify the cause! If you find this useful, feel free to share it with more operations colleagues~