Flash filesystem size used != in use

Hi, I have troubles with the filesystem. It is stated that I have used 3.4G but there are only files present that consume 129.9M.

root@turris:/# du -hd 1
1.6M    ./bin
2.6M    ./boot
0       ./dev
4.8M    ./etc
10.5M   ./lib
0       ./mnt
0       ./proc
4.0K    ./rom
12.0K   ./root
4.1M    ./sbin
0       ./srv
0       ./sys
1.5M    ./tmp
104.4M  ./usr
320.0K  ./www
8.0K    ./run
129.9M  .
root@turris:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/mmcblk0p1            7.3G      3.4G      4.0G  46% /
tmpfs                  1010.9M      1.7M   1009.2M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev

root@turris:/# mount -o remount,ro /dev/mmcblk0p1
root@turris:/# btrfsck /dev/mmcblk0p1 --force
WARNING: filesystem mounted, continuing because of --force
Checking filesystem on /dev/mmcblk0p1
UUID: be3b2f1e-56eb-48e2-bafd-55f8502e9c45
checking extents
checking free space cache
checking fs roots
checking csums
checking root refs
checking quota groups
found 3555557376 bytes used, no error found
total csum bytes: 3417992
total tree bytes: 54878208
total fs tree bytes: 47579136
total extent tree bytes: 3145728
btree space waste bytes: 11209070
file data blocks allocated: 3523391488
 referenced 3523235840
root@turris:/# mount -o remount,rw /dev/mmcblk0p1

Can it be an issue with the filesystem or flash device?
How can I check the integrity of the flash?

Snapshots with lots of data seem more likely.

TO uses btrfs on internal storage. Btrfs behaves diffrent from traditional file systems in terms of disk usage.

See: https://btrfs.wiki.kernel.org/index.php/FAQ#Understanding_free_space.2C_using_the_original_tools

For snapshot management see https://doc.turris.cz/doc/en/howto/schnapps

I have downloaded schnappi.sh and ran it:
root@turris:~# ./schnappi.sh
----------------------------------------------------------------------------
| ID | Size | Type | Date | Comment |
----------------------------------------------------------------------------
| 1 | 188.00KiB | pre | 2018-08-22 21:22 | Automatic pre-update snapshot |
| 2 | 672.00KiB | post | 2018-08-22 21:22 | Automatic post-update snapshot |
| 3 | 288.00KiB | pre | 2018-08-23 00:02 | Automatic pre-update snapshot |
| 4 | 64.00KiB | post | 2018-08-23 00:02 | Automatic post-update snapshot |
----------------------------------------------------------------------------

It is unlikely that there are a lot of snapshots because I made a factory reset yesterday (rootfs was read-only after reboot).

Post output of

btrfs fi usage /

The output is similar to the one of df:

root@turris:~# btrfs fi usage /
Overall:
    Device size:                   7.28GiB
    Device allocated:              4.42GiB
    Device unallocated:            2.86GiB
    Device missing:                  0.00B
    Used:                          3.31GiB
    Free (estimated):              3.90GiB      (min: 3.90GiB)
    Data ratio:                       1.00
    Metadata ratio:                   1.00
    Global reserve:               68.00MiB      (used: 0.00B)

Data+Metadata,single: Size:4.41GiB, Used:3.31GiB
   /dev/mmcblk0p1          4.41GiB

System,single: Size:4.00MiB, Used:4.00KiB
   /dev/mmcblk0p1          4.00MiB

Unallocated:
   /dev/mmcblk0p1          2.86GiB

Three leds factory reset is done by creating new btrfs snapshot. Old snapshot is still present. You can either revert to it or even mount it. And of course you can also remove it. If you let it there then it is autonatically removed afrer some time.

Now our tool is schnapps and it is already present on the router. Please do not use external tool although possibly compatible one. Run schnapps --help to see all possibilities.