Drive Critical notice reports disk usage higher than when checking manually via SSH

I get these mails daily from the cpanel server of our client:

From: cpanel@server.mydomain.com
subject: drivespace critical on server.mydomain.com

The content of the mail reads:
Drive Critical: /dev/sda3 (/) is 93% full

However, if I do a df -h in a root shell I get this:

Code:

Filesystem            Size  Used Avail Use% Mounted on
/dev/sda3             448G  176G  249G  42% /
/dev/sda1              99M   17M   77M  18% /boot
tmpfs                 2.0G     0  2.0G   0% /dev/shm
/usr/tmpDSK           3.9G   77M  3.6G   3% /tmp

So the /dev/sda3 is way from being full. Neither are there very big file transfers going on, so it can't get to a sudden more then 40% addition to get this email going.

How can this be fixed?

 

Oke I will try that next time it occurs again.

Thank you!
Could you give me the exact command to use? Because with du / I get everything.

 

Then I get this list:

Code:

4.0K    /.cpanel
0       /proc
91M     /etc
292K    /.spamassassin
72K     /dev
5.1M    /scripts
7.3M    /bin
31M     /sbin
12M     /boot
268M    /root
8.0K    /selinux
0       /misc
8.0K    /mnt
8.0K    /media
16K     /lost+found
8.0K    /srv
760M    /backup
1.6G    /var
5.1M    /tmp
0       /net
133M    /lib
0       /sys
7.8G    /usr
25M     /opt
165G    /home
176G    /

I presume when I do this when I get the notice, one of these directory's is probably a lot bigger then 165G?

There is only 1 jailshell account present, which is mine, which is not used anymore.
The only thing I can imagine is the running backup which is made nightly and transfers the backups to another server.

 

Re: Drive Critical notice reports disk usage higher than when checking manually via S

Yes thank you, I have daily backups enabled, but not daily but every 2 days.
I was checking yesterday and already thought about the bacup:

Due to the reply's here my thoughts were it was indeed probably not Cpanel but a user account so I checked the logs this night.
It seems one of the owners accounts (which has no limit) has a very big amount of data present, which indeed as you said, could cause this behaviour on backup.
He probably put it there for temporary backup, but forgot that this would also be backupped by Cpanel on this server, causing the problem.

Thank you all for thinking with me, I guess we found the cause.
The owner has been contacted about the files.