Check disk space usage on Linux with df and du commands

Check overall disk space with df

The df command reports filesystem-level disk space usage. The -h flag prints sizes in human-readable units like GB and MB instead of raw blocks.

df -h

Typical output looks like this:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   38G   10G  80% /
tmpfs           3.9G     0  3.9G   0% /dev/shm
/dev/sdb1       100G   85G   10G  90% /data

Focus on the Use% column. Anything above 85-90% deserves immediate attention, especially on the root filesystem or any partition holding application data.

Show filesystem type and inode usage

Running out of inodes can fill a disk even when there's plenty of free space, because the filesystem runs out of entries to track new files. This commonly happens with applications that create millions of small files, like session caches or mail queues.

df -hT

df -i

If IUse% is near 100% but disk space looks fine, the problem is inode exhaustion, not raw capacity.

Find large directories with du -sh

The du command reports actual disk usage of files and directories, which is what you need to find what's consuming space. The -s flag summarizes, -h makes it human-readable.

sudo du -sh /var/log

To check the size of every top-level directory under /var, run it with a wildcard and summarize each one individually.

sudo du -sh /var/*/ 2>/dev/null

Drill down recursively to find the worst offenders

Start broad and narrow down. This two-step approach is faster than scanning the whole filesystem at once.

sudo du -sh /* 2>/dev/null | sort -rh | head -n 15

Once you've identified the heaviest top-level directory, for example /var, repeat the scan one level deeper.

sudo du -sh /var/* 2>/dev/null | sort -rh | head -n 15

Keep drilling into the largest result until you reach specific files or log directories.

Find individual large files

Sometimes the problem isn't a directory full of small files but a single huge file, like a core dump, a database snapshot, or an unrotated log.

sudo find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null

This searches the current filesystem only (the -xdev flag prevents it from crossing into mounted network shares or other partitions) for files larger than 500MB and prints their size and path.

To sort results by size from largest to smallest:

sudo find / -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -rn | head -n 20

Combine df and du for full disk space analysis

df tells you which filesystem is full. du tells you what's filling it. Use them together for a complete picture.

df -h /
sudo du -sh /var/log/*.log 2>/dev/null | sort -rh | head -n 10

A good troubleshooting workflow is: check df -h to identify which mount point is full, then run du -sh against that specific mount point's subdirectories to locate the cause.

df -h /data
sudo du -sh /data/*/ 2>/dev/null | sort -rh | head -n 10

Identify hidden disk usage from deleted but open files

A common and confusing scenario: df shows a disk nearly full, but du can't find anything large enough to explain it. This happens when a process has a file open for writing, and that file gets deleted while the process keeps writing to it. The space isn't released until the process closes the file handle, even though the file no longer appears anywhere in the filesystem tree.

sudo lsof +L1

The +L1 flag lists open files with a link count less than 1, meaning the file has been deleted but is still held open by a process. The output shows the process name, PID, and size of the phantom file.

COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
nginx    1842 www-data  3w   REG   8,1  4294967296   0 /var/log/nginx/access.log (deleted)

To reclaim the space, restart or reload the process holding the file open. For logging daemons this is usually safe and often the correct fix after rotating logs.

sudo systemctl reload nginx

If the owning process can't be restarted immediately, you can sometimes truncate the file in place instead of deleting it, which releases the space without killing the process.

sudo truncate -s 0 /proc/1842/fd/3

Sort and filter du output to find space hogs quickly

For large filesystems, combine du with sort and head to immediately see the biggest consumers without scrolling through noise.

sudo du -ah /home/deploy 2>/dev/null | sort -rh | head -n 20

The -a flag includes individual files, not just directories, which is useful inside a single user's home directory or application data folder.

To exclude certain paths, like node_modules or vendor directories that you already know are large and expected, use --exclude.

sudo du -sh --exclude=node_modules --exclude=.git /opt/app