Find What Fills Your Linux Disk with df and du

Two commands, two questions

• df answers: how full is each disk? It is the view from above.
• du answers: which folders use the space? It looks inside the disk.

Use them together, in this order.

Step 1: Check the disks with df

df -h

-h shows sizes in KB, MB and GB. Read these columns:

• Filesystem is the device.
• Size, Used and Avail are the sizes.
• Use% is the part that is full.
• Mounted on is where the disk is attached.

To check one place, name it:

df -h /home

Look at Use%. Above 90% you should act. At 95-100% services can crash, updates can fail and logs stop being written.

Step 2: Find the big folders with du

Start at the top and go down one level at a time:

sudo du -h --max-depth=1 / 2>/dev/null | sort -rh | head -20

This lists the 20 biggest first-level folders. Pick the biggest and look inside:

sudo du -h --max-depth=1 /var | sort -rh | head -20

Repeat until you find the cause. Another useful form shows the size of each item in the current folder:

du -sh *

Step 3: Decide what to remove

Typical causes:

• Old log files in /var/log.
• Old backups and archives.
• Cache and temporary files.
• Unused Docker images.
• Large files nobody needs.

Move or compress before you delete. Never delete files if you do not know what they are.

Step 4: Check inodes

A disk can be "full" because there are too many small files:

df -i

If IUse% is near 100%, find folders with a huge number of files.

Common mistakes

1. Running du on / without a limit. It takes long and prints too much.
2. Ignoring inode use.
3. Deleting files that a program still has open. The space only returns after the program restarts.
4. Deleting a folder before you know what it holds.

Make it a routine

Check disk space on a schedule. For example, a cron job can run df -h every day and email you when Use% goes above 85%.

Quick recap

• df -h shows how full the disk is.
• du -h --max-depth=1 | sort -rh shows where the space went.
• Check inodes with df -i.