Trouble is that ntp is running in chroot by default.
To get rid of the duplicate /var/lib/ntp/proc directory (in which you
have copy of the regular /proc), do the following:
stop ntp daemon
edit /etc/sysconfig/ntp and set run in chroot to “no”
edit the script /etc/init.d/ntp and set run in chroot to “no”
start ntp daemon
Then you should have an empty /var/lib/ntp/proc
Well, that wouldn’t make it too secure then, wouldn’t it?
Just had a similar case as the size of the kcore file was shown by du
-sh. When maths done properly it was obvious that can be ignored as the
sum was much larger than the size of the filesystem.