# df & du — Analyze Disk Space on Linux

> Practical guide to df and du — check free space per filesystem, measure directory sizes and track down what fills up a disk.

Source: https://www.jpkc.com/db/en/cheatsheets/shell-system/df-du/

<!-- PROSE:intro -->
`df` and `du` are the pair that keep disk usage under control: `df` (disk free) reports usage at the filesystem level – one line per mounted partition – while `du` (disk usage) sums up the size of individual directories and files. When a disk fills up, this is your first stop: `df -h` tells you *which* filesystem is full, and `du -sh *` shows you *where* the space went. This guide takes you from a quick overview through hunting down large files to cleanup and monitoring patterns.
<!-- PROSE:intro:end -->

## df — Filesystem Overview

`df -h` — Show disk space usage for all mounted filesystems in human-readable format.

```bash
df -h
```

`df -h <path>` — Show disk space for the filesystem containing the given path.

```bash
df -h /var
```

`df -hT` — Show disk space with filesystem type (ext4, xfs, tmpfs, etc.).

```bash
df -hT
```

`df -i` — Show inode usage instead of block usage (diagnose 'no space left' with free blocks).

```bash
df -ih
```

`df -h --total` — Show a grand total line at the bottom.

```bash
df -h --total
```

`df -h -x tmpfs -x devtmpfs` — Exclude virtual filesystems (show only real disks).

```bash
df -h -x tmpfs -x devtmpfs -x squashfs
```

`df -h --output=source,size,used,avail,pcent,target` — Custom output columns.

```bash
df -h --output=source,size,avail,pcent,target
```

`df -h -t ext4` — Show only filesystems of a specific type.

```bash
df -h -t ext4
```

## du — Directory Sizes

`du -sh <dir>` — Show the total size of a directory in human-readable format.

```bash
du -sh /var/log
```

`du -sh *` — Show the size of each item in the current directory.

```bash
du -sh * | sort -rh
```

`du -sh */ | sort -rh` — Show sizes of subdirectories only, sorted largest first.

```bash
du -sh */ | sort -rh | head -10
```

`du -h <dir>` — Show sizes of all subdirectories recursively.

```bash
du -h /var/log
```

`du -h --max-depth=<n> <dir>` — Limit directory depth to n levels.

```bash
du -h --max-depth=1 /var
```

`du -ah <dir>` — Show sizes of all files and directories (not just directories).

```bash
du -ah /var/log | sort -rh | head -20
```

`du -sh <dir> --exclude='<pattern>'` — Exclude files or directories matching a pattern.

```bash
du -sh /var --exclude='*.log'
```

`du -sc <dirs> | sort -rh` — Show total for each specified directory with grand total.

```bash
du -sc /var/log /var/lib /var/cache | sort -rh
```

## Finding Large Files & Directories

`du -ah <dir> | sort -rh | head -<n>` — Find the n largest files and directories.

```bash
du -ah /var | sort -rh | head -20
```

`find <dir> -type f -size +<size> -exec ls -lh {} \;` — Find files larger than a given size.

```bash
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null
```

`find <dir> -type f -size +<size> | sort` — List all files over a size threshold.

```bash
find /var -type f -size +50M 2>/dev/null | sort
```

`find <dir> -type f -name '*.log' -size +<size>` — Find large log files specifically.

```bash
find /var/log -type f -name '*.log' -size +10M
```

`find <dir> -xdev -type f -size +<size> | head -20` — Find large files without crossing filesystem boundaries (-xdev).

```bash
find / -xdev -type f -size +500M 2>/dev/null | head -20
```

## Disk Cleanup Patterns

`du -sh /var/log/*.gz` — Check size of compressed old log files.

```bash
du -sh /var/log/*.gz /var/log/*.[0-9]
```

`find /var/log -name '*.gz' -mtime +<days> -delete` — Delete compressed logs older than n days.

```bash
find /var/log -name '*.gz' -mtime +30 -delete
```

`journalctl --disk-usage` — Check how much space systemd journal logs use.

```bash
journalctl --disk-usage
```

`journalctl --vacuum-size=<size>` — Reduce journal logs to a maximum size.

```bash
sudo journalctl --vacuum-size=500M
```

`journalctl --vacuum-time=<time>` — Remove journal logs older than a duration.

```bash
sudo journalctl --vacuum-time=7d
```

`docker system df` — Show Docker disk usage (images, containers, volumes, build cache).

```bash
docker system df -v
```

`docker system prune -a` — Remove unused Docker data (images, containers, networks).

```bash
docker system prune -a --volumes
```

## Monitoring & Scripting

`df -h / | awk 'NR==2 {print $5}'` — Extract the usage percentage of the root filesystem.

```bash
df -h / | awk 'NR==2 {print "Root usage: " $5}'
```

`df -h | awk '$5+0 > 80'` — Show filesystems that are over 80% full.

```bash
df -h | awk '+$5 > 80 {print $6 ": " $5 " full"}'
```

`watch -n 5 df -h` — Monitor disk usage in real-time, refreshing every 5 seconds.

```bash
watch -n 5 'df -h | grep -v tmpfs'
```

`ncdu <dir>` — Interactive disk usage analyzer with ncurses UI (install ncdu).

```bash
ncdu /var
```

`lsblk -f` — List block devices with filesystem info and mount points.

```bash
lsblk -f
```

`findmnt -D` — Show mounted filesystems with disk space usage (similar to df).

```bash
findmnt -D
```

<!-- PROSE:outro -->
## Conclusion

`df` and `du` complement each other: `df` gives you a filesystem-level overview in seconds, while `du` then digs into directories to pinpoint the culprit – both with `-h` for readable sizes and `du -sh *` as the everyday classic. Watch out for two pitfalls, though: `du` can be slow on large trees because it walks many files, and you may see an apparent discrepancy when `df` reports more usage than `du` – this usually comes from files that were deleted but are still held open by a running process (track them down with `lsof`) or from reserved filesystem blocks. The read-only operations are harmless; take care only with the cleanup commands: `find … -delete` and `journalctl --vacuum-*` remove data permanently – test the pattern without `-delete` first.

## Further Reading

- [man7.org: df(1)](https://man7.org/linux/man-pages/man1/df.1.html) – the GNU coreutils manual page for reporting free space per filesystem
- [man7.org: du(1)](https://man7.org/linux/man-pages/man1/du.1.html) – the GNU coreutils manual page for estimating directory and file sizes
<!-- PROSE:outro:end -->

## Related Commands

- [lsblk](https://www.jpkc.com/db/en/cheatsheets/shell-system/lsblk/) – list block devices, partitions and mount points
- [mount](https://www.jpkc.com/db/en/cheatsheets/shell-system/mount/) – attach filesystems and inspect current mounts
- [dd](https://www.jpkc.com/db/en/cheatsheets/shell-system/dd/) – copy and write data blocks and images at the device level

