How to Display Disk Usage in Linux

How to Display Disk Usage in Linux

Managing disk space effectively stands as one of the fundamental responsibilities for anyone working with Linux systems. Whether you're maintaining a personal workstation, managing enterprise servers, or developing applications in containerized environments, understanding how much storage your files and directories consume directly impacts system performance, application stability, and overall operational efficiency. When storage runs low unexpectedly, services can fail, databases can become corrupted, and critical processes may halt without warning.

Disk usage monitoring in Linux refers to the practice of examining how storage space is allocated across filesystems, directories, and individual files. The Linux ecosystem provides multiple built-in utilities and third-party tools that offer different perspectives on storage consumption—from simple command-line outputs to interactive visual representations. This comprehensive approach allows administrators and users to identify space-consuming files, track growth patterns, and make informed decisions about cleanup, archiving, or expansion strategies.

Throughout this exploration, you'll discover practical commands for checking disk space at various levels of granularity, learn to interpret the output from different utilities, understand advanced filtering and sorting techniques, and gain insights into automation strategies for continuous monitoring. You'll also find ready-to-use examples, comparative tables of tool capabilities, and best practices that address real-world scenarios encountered in production environments.

Essential Command-Line Tools for Disk Space Analysis

Linux distributions come equipped with several powerful utilities designed specifically for examining disk usage. These tools vary in their approach—some focus on filesystem-level information, while others drill down into directory structures. Understanding when to use each tool transforms disk management from guesswork into a systematic process.

The df command provides a high-level view of filesystem usage across all mounted partitions. It displays total space, used space, available space, and the percentage of utilization for each filesystem. This tool excels at answering questions like "Which partition is running out of space?" or "How much room remains on my root filesystem?" The output includes device names, mount points, and usage statistics that help identify problematic volumes at a glance.

In contrast, the du command examines disk usage at the directory and file level. Rather than summarizing entire filesystems, du traverses directory trees and calculates the space consumed by each subdirectory and file. This granular approach proves invaluable when you know a particular partition is full but need to identify which directories or files are responsible for consuming the space.

Understanding df Output and Options

When executed without options, df displays information in 1K blocks, which can be difficult to interpret quickly. Adding the -h flag transforms the output into human-readable format with units like MB, GB, and TB. The -T option includes filesystem types, helping distinguish between ext4, xfs, tmpfs, and other filesystem formats. For focused analysis, -t filters results to show only specific filesystem types, while -x excludes unwanted types from the display.

df -h
df -hT
df -h -t ext4
df -h --total

The --total flag adds a summary row showing aggregate statistics across all filesystems, providing a quick overview of total storage capacity and usage. For systems with numerous mount points, this summary helps assess overall storage health without manually calculating totals. The -i option shifts focus from space usage to inode consumption, revealing situations where a filesystem runs out of inodes despite having available space—a common issue with directories containing millions of small files.

"Understanding the difference between space exhaustion and inode exhaustion can save hours of troubleshooting when applications fail to create new files despite apparent free space."

Mastering du for Directory Analysis

The du command becomes exponentially more useful when combined with its various options and piped through sorting utilities. The -h flag again provides human-readable output, while -s summarizes each argument without showing subdirectories. The -c option produces a grand total, and --max-depth limits how deep du descends into directory hierarchies.

du -h /var/log
du -sh /home/*
du -h --max-depth=1 /var | sort -h
du -ah /etc | sort -h | tail -20

The -a flag includes files in the output, not just directories, enabling comprehensive analysis of space consumption. Combining du with sort and tail creates powerful one-liners that immediately reveal the largest space consumers. The -x option prevents du from crossing filesystem boundaries, ensuring analysis remains confined to a single partition—particularly useful when examining directories that contain mount points to other filesystems.

For excluding specific directories from analysis, the --exclude option proves invaluable. This becomes essential when certain directories like backups or caches would skew results or when you want to focus on user-generated content while ignoring system directories. Multiple exclude patterns can be specified to fine-tune the scope of analysis.

du -sh --exclude='*.log' /var
du -h --exclude='/var/cache' --max-depth=2 /var
du -ch --exclude='node_modules' ~/projects/*/

Advanced Techniques for Identifying Space Consumers

Beyond basic commands, combining utilities through pipes and leveraging advanced options enables sophisticated analysis workflows. These techniques help pinpoint specific files, identify growth patterns, and automate discovery of storage issues before they become critical.

Finding Large Files Across the Filesystem

The find command, while primarily designed for locating files based on various criteria, becomes a powerful disk usage tool when combined with size-based filters and formatting options. Finding all files larger than a specific threshold across the entire filesystem or within targeted directories quickly identifies candidates for cleanup or archiving.

find /home -type f -size +100M -exec ls -lh {} \;
find / -type f -size +1G -printf '%s %p\n' 2>/dev/null | sort -n
find /var/log -type f -size +50M -mtime +30

The -size parameter accepts various units: c for bytes, k for kilobytes, M for megabytes, and G for gigabytes. The plus sign indicates "greater than," while minus indicates "less than." Combining size criteria with modification time using -mtime helps identify large old files that might be safe to archive. The -printf option formats output for easier parsing and sorting, while redirecting stderr to /dev/null suppresses permission denied errors when scanning system directories.

Analyzing Specific Directory Structures

Different directories require different analysis approaches. Log directories benefit from time-based analysis to identify files that should have been rotated. Home directories need per-user breakdowns to identify quota violations or excessive consumption. Application directories often contain cache or temporary files that can be safely removed.

du -sh /var/log/* | sort -h
du -sh /home/* | sort -h
du -h --max-depth=2 /opt | sort -h | tail -15
find /tmp -type f -atime +7 -size +10M

"Regular analysis of standard directories like /var, /tmp, and /home prevents 90% of space-related incidents before they impact services."

For web servers, analyzing document roots and upload directories helps identify orphaned files or excessive user uploads. Database servers benefit from examining data directories and transaction logs. Container environments require monitoring of image storage and volume mounts. Each use case demands tailored commands that focus on relevant paths and file types.

Interactive and Visual Disk Usage Tools

While command-line utilities provide powerful functionality, interactive tools offer enhanced user experience through visual representations and keyboard-driven navigation. These tools prove especially valuable when exploring unfamiliar directory structures or when you need to quickly drill down through multiple hierarchy levels.

NCurses Disk Usage (ncdu)

The ncdu utility combines the analytical power of du with an interactive ncurses interface. After scanning a directory tree, it presents results in a navigable list where arrow keys move between entries, Enter descends into directories, and various keyboard shortcuts enable actions like deletion or information display. The interface shows size, percentage of parent, and item count for each entry.

ncdu /home
ncdu -x /var
ncdu --exclude node_modules ~/projects

Installation varies by distribution but typically involves package managers: apt install ncdu for Debian-based systems, yum install ncdu for RHEL-based systems, or pacman -S ncdu for Arch. The -x flag prevents crossing filesystem boundaries, while --exclude skips specified patterns during scanning. The interface supports sorting by size or name, toggling between different units, and displaying file counts alongside space usage.

Baobab and Graphical Alternatives

Desktop environments often include graphical disk usage analyzers. GNOME provides Baobab (Disk Usage Analyzer), which generates treemap visualizations where rectangle sizes represent space consumption. KDE offers KDiskFree and Filelight with similar functionality. These tools excel at providing intuitive visual understanding of storage distribution but require graphical sessions and may not be available on headless servers.

For systems with GUI access, these tools complement command-line utilities by offering different perspectives on the same data. Treemaps make proportional relationships immediately apparent, while ring charts show hierarchical relationships. Most graphical tools also support scanning remote filesystems over SSH, extending their utility beyond local analysis.

"Visual tools reduce cognitive load when analyzing complex directory structures, making patterns visible that might be missed in text-based output."

Automation and Monitoring Strategies

Reactive disk space management—responding to issues after they occur—leads to service disruptions and emergency maintenance windows. Proactive monitoring through automated scripts and scheduled checks enables early detection and planned remediation. Implementing systematic monitoring transforms disk management from crisis response to routine maintenance.

Creating Disk Space Monitoring Scripts

Shell scripts that regularly check disk usage and send alerts when thresholds are exceeded form the foundation of proactive monitoring. These scripts typically run via cron, check usage percentages, and trigger notifications through email, messaging platforms, or logging systems when consumption exceeds defined limits.

#!/bin/bash
THRESHOLD=80
df -H | grep -vE '^Filesystem|tmpfs|cdrom' | awk '{ print $5 " " $6 }' | while read output;
do
  usage=$(echo $output | awk '{ print $1}' | cut -d'%' -f1)
  partition=$(echo $output | awk '{ print $2 }')
  if [ $usage -ge $THRESHOLD ]; then
    echo "Warning: $partition is ${usage}% full"
  fi
done

Enhanced versions of such scripts might include historical tracking, growth rate calculations, and predictive alerts based on consumption trends. Storing daily snapshots of disk usage enables analysis of growth patterns and identification of unusual spikes that might indicate issues like runaway processes, failed log rotation, or data retention policy violations.

Integrating with Monitoring Systems

Enterprise environments typically employ dedicated monitoring platforms like Nagios, Zabbix, Prometheus, or commercial solutions. These systems provide centralized dashboards, historical graphing, and sophisticated alerting with escalation policies. Most support agent-based monitoring where lightweight processes on each server report metrics to central collectors, enabling organization-wide visibility into storage consumption.

Configuration typically involves defining check intervals, threshold values for warning and critical states, and notification channels. Modern monitoring systems support dynamic thresholds that adjust based on historical patterns, reducing false positives from expected daily fluctuations while maintaining sensitivity to genuine issues.

Log Rotation and Automated Cleanup

Prevention proves more effective than detection. Proper log rotation policies, automated cleanup of temporary files, and retention policies for backups prevent many disk space issues before they occur. The logrotate utility handles log file management, compressing old logs and deleting ancient ones according to configured policies.

/var/log/myapp/*.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0640 appuser appgroup
}

Similar automation applies to temporary directories, cache files, and backup retention. Systemd timers or cron jobs can execute cleanup scripts that remove files older than specified ages, archive infrequently accessed data to slower storage tiers, or trigger alerts when automated cleanup fails to maintain usage below target thresholds.

"Automated cleanup policies should always include safety margins and verification steps—aggressive deletion without safeguards creates more problems than it solves."

Troubleshooting Common Disk Space Issues

Even with monitoring and automation, unexpected disk space issues occur. Deleted files that remain open by processes, filesystem corruption, hidden directories, and mount point shadowing all create scenarios where standard tools report confusing or contradictory information. Systematic troubleshooting approaches help resolve these situations efficiently.

Deleted Files Still Consuming Space

One of the most perplexing situations occurs when deleting large files fails to free expected space. This happens when processes maintain open file handles to deleted files. The filesystem marks the file as deleted but cannot reclaim the space until all processes close their handles. The lsof command identifies processes holding open deleted files.

lsof +L1
lsof | grep deleted
lsof -nP | grep '(deleted)'

The output shows process IDs, users, and file paths. Resolution typically involves restarting the offending processes gracefully or, in urgent situations, terminating them. Log rotation systems sometimes create this scenario when they move log files without signaling applications to reopen them. Proper rotation configurations include postrotate scripts that signal applications to close and reopen log files.

Hidden Directories and Mount Point Shadowing

Files created in a directory before a filesystem is mounted over that directory become invisible but continue consuming space. Unmounting the filesystem reveals the hidden files. This scenario often occurs with /tmp, /var, or /home when separate partitions are mounted over these directories after files have been created in the underlying directory.

umount /mnt/data
ls -lha /mnt/data
mount /dev/sdb1 /mnt/data

Regular audits of mount points and careful attention during system configuration prevent this issue. Documentation of intended mount points and verification that directories are empty before mounting filesystems over them eliminates this class of problems.

"Always verify that df and du report consistent totals—significant discrepancies indicate deleted files held open by processes or mount point shadowing."

Inode Exhaustion Without Space Exhaustion

Filesystems allocate a fixed number of inodes during creation, limiting the number of files regardless of available space. Systems hosting millions of small files—email servers, cache directories, or certain databases—can exhaust inodes while space remains available. The df -i command reveals inode usage, and resolution requires deleting files or recreating the filesystem with more inodes.

df -i
find /var/spool/mail -type f | wc -l
find /var/cache -type f -size 0 -delete

Prevention involves sizing inode counts appropriately during filesystem creation using mkfs options. For existing filesystems, regular cleanup of zero-byte files, consolidated storage of small files, or migration to filesystems with dynamic inode allocation provides solutions.

Filesystem Corruption and Inconsistencies

Corruption causes filesystems to report incorrect usage statistics or become unable to reclaim space from deleted files. Filesystem check utilities like fsck (for ext filesystems), xfs_repair (for XFS), or btrfs check (for Btrfs) diagnose and repair corruption. These tools require unmounted filesystems or read-only mounts, often necessitating booting from rescue media for root filesystems.

fsck -y /dev/sda1
xfs_repair /dev/sdb1
btrfs check --repair /dev/sdc1

Regular filesystem checks during scheduled maintenance windows prevent minor corruption from escalating into major data loss. Modern filesystems with journaling reduce corruption risk but don't eliminate it entirely. Proper shutdown procedures, reliable hardware, and UPS protection for critical systems minimize corruption incidents.

Best Practices for Ongoing Disk Management

Effective disk space management combines technical tools with organizational processes. Establishing standards, documenting procedures, and fostering awareness across teams prevents issues and ensures rapid response when problems occur.

🔍 Establishing Baseline Metrics and Growth Trends

Understanding normal usage patterns enables recognition of abnormal conditions. Recording disk usage weekly or monthly creates historical baselines that reveal growth trends. Linear growth suggests normal accumulation, while sudden spikes indicate issues requiring investigation. Seasonal patterns in certain applications become visible over annual cycles.

Tools like sar, vmstat, or custom scripts can collect and store historical data. Graphing utilities transform raw numbers into visual trends that make patterns immediately apparent. Capacity planning uses these trends to predict when expansions will be necessary, enabling procurement and installation before space becomes critical.

📋 Implementing Storage Policies and Quotas

User and application quotas prevent individual consumers from monopolizing shared storage. Filesystem quota systems enforce hard limits that prevent exceeding allocations and soft limits that warn when approaching thresholds. Quota policies should align with organizational needs, providing sufficient space for legitimate use while preventing abuse or accidental consumption.

quota -u username
repquota -a
edquota -u username

Modern systems support project quotas that apply to directory trees rather than user accounts, enabling per-application or per-dataset limits. Container environments benefit from volume size limits that prevent individual containers from consuming excessive space. Cloud environments offer similar controls through provider-specific management interfaces.

"Quotas work best when combined with user education—people avoid hitting limits when they understand why limits exist and how to manage their consumption."

💾 Data Lifecycle Management and Archival

Not all data requires immediate access on high-performance storage. Hierarchical storage management moves infrequently accessed data to cheaper, slower storage tiers. Automated policies based on access time, file age, or explicit tagging trigger migrations. Users retain transparent access while costs decrease and primary storage remains available for active workloads.

Cloud storage tiers, tape archives, or network-attached storage serve as archival destinations. Retention policies define how long different data types must be preserved, enabling deletion once retention periods expire. Compliance requirements often mandate minimum retention periods, while practical considerations suggest maximum periods beyond which data loses value.

🛡️ Backup Strategy Impact on Disk Usage

Backup systems significantly impact disk usage, especially when backups reside on the same systems as production data. Incremental and differential backup strategies reduce storage requirements compared to full backups. Deduplication eliminates redundant data across backup sets. Compression reduces backup sizes, trading CPU cycles for storage savings.

Backup retention policies balance recovery needs against storage costs. Common approaches include daily backups retained for a week, weekly backups for a month, and monthly backups for a year. Testing restoration procedures validates that backups remain viable and that retention periods provide adequate recovery windows.

⚡ Performance Considerations

Disk usage analysis commands themselves consume resources. Running du on large directory trees generates substantial I/O, potentially impacting application performance. Scheduling intensive analysis during maintenance windows or low-activity periods minimizes impact. The nice and ionice commands reduce priority of analysis processes, allowing production workloads to take precedence.

nice -n 19 du -sh /var
ionice -c 3 find / -size +1G

Monitoring systems should balance check frequency against resource consumption. Checking every minute provides rapid detection but creates unnecessary load. Hourly or daily checks suffice for most scenarios, with more frequent checks reserved for filesystems with known rapid growth or critical applications.

What is the fastest way to check disk usage in Linux?

The df command with the -h flag provides the quickest overview of filesystem usage across all mounted partitions. Executing df -h returns results in seconds, showing usage percentages for each filesystem. For more detailed analysis of specific directories, du -sh /path/to/directory summarizes that directory's total consumption without descending into subdirectories, offering a balance between speed and detail.

How do I find which directory is using the most disk space?

Combine du with sort and head to identify the largest directories. The command du -h --max-depth=1 /path | sort -h | tail -10 shows the ten largest subdirectories under the specified path. For system-wide analysis, run du -sh /* | sort -h to see top-level directory consumption. The ncdu tool provides an interactive alternative that allows drilling down into large directories with keyboard navigation.

Why does df show different usage than du?

Discrepancies between df and du typically result from deleted files held open by processes, filesystem metadata overhead, or mount point shadowing. When processes maintain file handles to deleted files, the space remains allocated until the process closes the file or terminates. Use lsof +L1 to identify such files. Filesystem metadata (inodes, journals, reserved blocks) also consumes space counted by df but not by du. Reserved blocks for root user, typically 5% of filesystem capacity, appear as used space to df but aren't visible to du when run as non-root.

How can I monitor disk usage automatically?

Create a shell script that checks disk usage and sends alerts when thresholds are exceeded, then schedule it with cron. A basic script uses df to check usage percentages and sends email notifications for filesystems exceeding defined limits. For enterprise environments, monitoring platforms like Nagios, Zabbix, or Prometheus provide centralized monitoring with historical graphing, sophisticated alerting, and dashboard visualization. Cloud environments offer native monitoring services like CloudWatch or Azure Monitor that integrate directly with virtual machines and storage services.

What should I do when disk space fills up unexpectedly?

First, identify what consumed the space using du -h --max-depth=1 / to find large top-level directories, then drill down into suspicious areas. Check for deleted files held open with lsof +L1 and restart or terminate the processes if appropriate. Examine log directories for excessive growth due to failed rotation with du -sh /var/log/*. Look for core dumps in /var/crash or /tmp. Use find / -type f -size +1G to locate large files. Once identified, remove unnecessary files, archive old data, or expand the filesystem if all data is needed. Implement monitoring and cleanup automation to prevent recurrence.

How do I check disk usage for specific file types?

The find command combined with du enables analysis of specific file types. For example, find /home -name "*.log" -exec du -ch {} + | tail -1 calculates total space consumed by log files. For video files, use find /home -type f \( -name "*.mp4" -o -name "*.avi" -o -name "*.mkv" \) -exec du -ch {} + | tail -1. The -exec option runs du on each found file, while the final tail command shows the total. For better performance on large filesystems, use find /path -name "*.ext" -printf "%s\n" | awk '{total+=$1} END {print total/1024/1024" MB"}' to sum file sizes without invoking du repeatedly.