Linux Basic — Disk Usage: df and du

Disk Usage: df and du

Running out of disk space is one of the most common causes of production outages. Linux provides two essential commands to investigate: df (disk free — filesystem level) and du (disk usage — directory level).

---

df — Filesystem-Level Space

df reports space at the filesystem (partition) level: how much is used and how much is free on each mounted filesystem.

df -h
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda1        20G   14G  4.9G  74% /
# tmpfs           985M  1.4M  984M   1% /run
# /dev/sda15      105M  6.1M   99M   6% /boot/efi
# tmpfs           985M     0  985M   0% /dev/shm

# -h = human-readable (K, M, G instead of raw bytes)

Column Reference

Column	Meaning
Filesystem	The device or virtual FS
Size	Total capacity
Used	Space consumed
Avail	Space available (not just total minus used — reserved blocks exist)
Use%	Percentage used
Mounted on	Where it appears in the directory tree

---

Common df Options

# Check a specific path (shows the filesystem that path lives on)
df -h /var
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda1        20G   14G  4.9G  74% /

df -h /home
# If /home is on a separate partition, shows just that partition

# Show all filesystems including pseudo ones
df -ha

# Show filesystem type
df -hT
# Filesystem     Type      Size  Used Avail Use% Mounted on
# /dev/sda1      ext4       20G   14G  4.9G  74% /
# tmpfs          tmpfs     985M  1.4M  984M   1% /run

# Show inode usage (critical — see below)
df -i
# Filesystem     Inodes  IUsed   IFree IUse% Mounted on
# /dev/sda1      655360  42301  613059    7% /
# tmpfs          499200     25  499175    1% /run

---

The Inode Trap: “No Space Left on Device”

A filesystem can be full of inodes even when disk space is available. This causes errors like:

mkdir: cannot create directory '/var/spool/exim4': No space left on device

But df -h shows free space. The fix: check inodes.

df -i
# Filesystem     Inodes   IUsed   IFree IUse% Mounted on
# /dev/sda1      655360  655360       0  100% /    ← OUT OF INODES!

# Who created all those inodes? Find the directory with the most files:
find / -xdev -maxdepth 6 -printf '%h\n' \
  | sort | uniq -c | sort -rn | head -10
# Common culprits: /var/spool/exim4, /tmp, mail queues, log files, npm caches

---

du — Directory-Level Usage

du measures how much disk space a specific directory or file occupies.

# Summary of a single directory
du -sh /var/log
# 248M    /var/log

# Summary of everything in current directory
du -sh *
# 4.0K    bin
# 12K     etc
# 248M    log
# 8.0K    run

# One level deep
du -h --max-depth=1 /var
# 8.0K    /var/backups
# 248M    /var/log
# 24M     /var/cache
# 2.1G    /var/lib
# 2.4G    /var

# -s = summary (one line per argument, no subdirectories)
# -h = human-readable

---

Finding the Biggest Consumers

# Sort by size, largest first
du -sh /var/log/* | sort -rh | head -10
# 189M    /var/log/journal
#  22M    /var/log/syslog
#  15M    /var/log/kern.log
#  10M    /var/log/auth.log

# Same trick at any level
du -sh /home/* | sort -rh
du -sh /usr/share/* | sort -rh | head -5

# Find large files directly (over 100 MB)
find /var -type f -size +100M -exec ls -lh {} \;

# Find large files, sorted
find / -xdev -type f -size +50M -printf '%s %p\n' \
  | sort -rn | awk '{print $1/1024/1024 "MB", $2}' | head -10

---

Excluding Directories

# Skip a filesystem (--one-file-system / -x)
du -sh --exclude=/proc /

# Skip specific paths
du -sh /var --exclude=/var/lib/docker

---

ncdu — Interactive Disk Usage Browser

ncdu is an ncurses-based interactive version of du — far easier for exploratory investigation:

# Install
sudo apt install ncdu        # Debian/Ubuntu
sudo yum install ncdu        # RHEL/CentOS
brew install ncdu            # macOS

# Run (scans current directory)
ncdu

# Scan a specific path
ncdu /var

# Controls in ncdu:
# ↑ ↓ = navigate
# Enter = drill down into directory
# d = delete selected item (with confirmation)
# n = sort by name, s = sort by size (default)
# q = quit

---

Practical Troubleshooting Workflow

When a disk alert fires or No space left on device appears:

# Step 1: Check overall disk space
df -h

# Step 2: Check inode usage (often overlooked)
df -i

# Step 3: Find the biggest directories on the affected filesystem
du -h --max-depth=2 / 2>/dev/null | sort -rh | head -20

# Step 4: Drill down into the biggest offender
du -sh /var/log/* | sort -rh | head -10

# Step 5: Check for deleted-but-open files (common in production)
# Files deleted while a process still has them open don't free space until the process restarts
sudo lsof +L1 | grep DEL

# Step 6: Identify top large files directly
find /var -xdev -type f -size +50M -printf '%s\t%p\n' \
  | sort -rn | head -10

# Step 7: Common quick wins
sudo journalctl --vacuum-size=500M     # Trim systemd journal logs
sudo apt autoremove && sudo apt clean  # Clear apt cache
docker system prune -a                 # Remove unused Docker layers (if applicable)

---

Quick Reference

Command	Purpose
df -h	Filesystem-level space (human-readable)
df -i	Inode usage per filesystem
df -hT	Space + filesystem type
du -sh /path	Total size of a directory
du -sh *	Size of each item in current dir
du -h --max-depth=1 /var	One-level breakdown of /var
du -sh * \| sort -rh	Sorted by size, largest first
ncdu /var	Interactive explorer
find / -size +100M	Files over 100 MB
lsof +L1	Open files with link count 0 (deleted but in use)

---

Key Takeaways

• df -h shows filesystem-level free/used space; df -i shows inode usage
• “No space left on device” with free disk space means inodes are exhausted — check df -i
• du -sh * quickly shows what’s consuming space in the current directory
• du -sh * | sort -rh | head -10 finds the top 10 space consumers
• ncdu is the interactive, ergonomic alternative to du for investigation
• Deleted files held open by processes don’t free disk space — use lsof +L1 to find them

---

← Back to Hard Links and Symlinks

Next → Practice Exercises