df & du — Analyze Disk Space on Linux

df and du are the pair that keep disk usage under control: df (disk free) reports usage at the filesystem level – one line per mounted partition – while du (disk usage) sums up the size of individual directories and files. When a disk fills up, this is your first stop: df -h tells you which filesystem is full, and du -sh * shows you where the space went. This guide takes you from a quick overview through hunting down large files to cleanup and monitoring patterns.

df — Filesystem Overview

df -h — Show disk space usage for all mounted filesystems in human-readable format.

df -h

df -h <path> — Show disk space for the filesystem containing the given path.

df -h /var

df -hT — Show disk space with filesystem type (ext4, xfs, tmpfs, etc.).

df -hT

df -i — Show inode usage instead of block usage (diagnose 'no space left' with free blocks).

df -ih

df -h --total — Show a grand total line at the bottom.

df -h --total

df -h -x tmpfs -x devtmpfs — Exclude virtual filesystems (show only real disks).

df -h -x tmpfs -x devtmpfs -x squashfs

df -h --output=source,size,used,avail,pcent,target — Custom output columns.

df -h --output=source,size,avail,pcent,target

df -h -t ext4 — Show only filesystems of a specific type.

df -h -t ext4

du — Directory Sizes

du -sh <dir> — Show the total size of a directory in human-readable format.

du -sh /var/log

du -sh * — Show the size of each item in the current directory.

du -sh * | sort -rh

du -sh */ | sort -rh — Show sizes of subdirectories only, sorted largest first.

du -sh */ | sort -rh | head -10

du -h <dir> — Show sizes of all subdirectories recursively.

du -h /var/log

du -h --max-depth=<n> <dir> — Limit directory depth to n levels.

du -h --max-depth=1 /var

du -ah <dir> — Show sizes of all files and directories (not just directories).

du -ah /var/log | sort -rh | head -20

du -sh <dir> --exclude='<pattern>' — Exclude files or directories matching a pattern.

du -sh /var --exclude='*.log'

du -sc <dirs> | sort -rh — Show total for each specified directory with grand total.

du -sc /var/log /var/lib /var/cache | sort -rh

Finding Large Files & Directories

du -ah <dir> | sort -rh | head -<n> — Find the n largest files and directories.

du -ah /var | sort -rh | head -20

find <dir> -type f -size +<size> -exec ls -lh {} \; — Find files larger than a given size.

find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null

find <dir> -type f -size +<size> | sort — List all files over a size threshold.

find /var -type f -size +50M 2>/dev/null | sort

find <dir> -type f -name '*.log' -size +<size> — Find large log files specifically.

find /var/log -type f -name '*.log' -size +10M

find <dir> -xdev -type f -size +<size> | head -20 — Find large files without crossing filesystem boundaries (-xdev).

find / -xdev -type f -size +500M 2>/dev/null | head -20

Disk Cleanup Patterns

du -sh /var/log/*.gz — Check size of compressed old log files.

du -sh /var/log/*.gz /var/log/*.[0-9]

find /var/log -name '*.gz' -mtime +<days> -delete — Delete compressed logs older than n days.

find /var/log -name '*.gz' -mtime +30 -delete

journalctl --disk-usage — Check how much space systemd journal logs use.

journalctl --disk-usage

journalctl --vacuum-size=<size> — Reduce journal logs to a maximum size.

sudo journalctl --vacuum-size=500M

journalctl --vacuum-time=<time> — Remove journal logs older than a duration.

sudo journalctl --vacuum-time=7d

docker system df — Show Docker disk usage (images, containers, volumes, build cache).

docker system df -v

docker system prune -a — Remove unused Docker data (images, containers, networks).

docker system prune -a --volumes

Monitoring & Scripting

df -h / | awk 'NR==2 {print $5}' — Extract the usage percentage of the root filesystem.

df -h / | awk 'NR==2 {print "Root usage: " $5}'

df -h | awk '$5+0 > 80' — Show filesystems that are over 80% full.

df -h | awk '+$5 > 80 {print $6 ": " $5 " full"}'

watch -n 5 df -h — Monitor disk usage in real-time, refreshing every 5 seconds.

watch -n 5 'df -h | grep -v tmpfs'

ncdu <dir> — Interactive disk usage analyzer with ncurses UI (install ncdu).

ncdu /var

lsblk -f — List block devices with filesystem info and mount points.

lsblk -f

findmnt -D — Show mounted filesystems with disk space usage (similar to df).

findmnt -D

Conclusion

df and du complement each other: df gives you a filesystem-level overview in seconds, while du then digs into directories to pinpoint the culprit – both with -h for readable sizes and du -sh * as the everyday classic. Watch out for two pitfalls, though: du can be slow on large trees because it walks many files, and you may see an apparent discrepancy when df reports more usage than du – this usually comes from files that were deleted but are still held open by a running process (track them down with lsof) or from reserved filesystem blocks. The read-only operations are harmless; take care only with the cleanup commands: find … -delete and journalctl --vacuum-* remove data permanently – test the pattern without -delete first.