Linux Disk Space: df, du and Finding Large Files

"No space left on device" is one of the most common server problems. A full disk can stop databases, logs and deployments. Here is how to find what is using the space.

How much is free?#

df (disk free) shows each file system, and -h makes the sizes readable:

df -h / | cut -c1-55

Filesystem      Size  Used Avail Use% Mounted on
/dev/root        72G   59G   13G  83% /

Watch the Use% column. A server above about 90% needs attention.

What is using it?#

du (disk usage) measures folders:

du -sh data
du -sh data/*

11M	data
2.9M	data/images
7.7M	data/logs
496K	data/tmp

-s gives one total for each argument. Add sort to see the biggest first:

du -h --max-depth=1 data | sort -hr

11M	data
7.7M	data/logs
2.9M	data/images
496K	data/tmp

sort -h understands sizes such as 7.7M and 496K. A common way to investigate is to start at / and go into the biggest folder each time:

sudo du -h --max-depth=1 / 2> /dev/null | sort -hr | head

Find large files#

find data -type f -size +1M -exec ls -lh {} + | awk '{print $5, $NF}'

2.9M data/images/photo.raw
7.7M data/logs/app.log

Common space users#

Deleted but still using space#

If df says the disk is full, but du shows much less, a process may still hold a deleted file open. This shows it, and restarting the process frees the space:

sudo lsof +L1

Inodes#

Each file uses an inode, and a disk has a limited number of them. Millions of tiny files can fill the inodes, while df -h still shows free space. Check with:

df -i / | awk 'NR == 2 {print "Inodes used:", $5}'

Inodes used: 12%

Disks and partitions#

lsblk shows disks and where they are attached:

lsblk -d -o NAME,SIZE,TYPE | head -n 3

NAME SIZE TYPE
sda   75G disk

In Linux, a disk is mounted on a folder. That folder then shows the disk's contents:

sudo mkdir /mnt/data
sudo mount /dev/sdb1 /mnt/data
sudo umount /mnt/data

To mount a disk at every boot, add it to /etc/fstab. A mistake in that file can stop the system from booting, so check it with sudo mount -a before restarting.

Common mistakes#

Practice#

du -sh data/* | sort -hr | head -n 1

7.7M	data/logs

Key takeaway#

Next: Archives with tar and gzip.