Checking Disk Space with df and du

How full is a filesystem? df

df (disk free) reports, for each mounted filesystem, its size, how much is used and how much is free. -h makes the numbers human-readable. Point it at a directory to see just the filesystem that holds it:

df -h
df -h /mnt/data

In the terminal

student@vulntech:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            224M     0  224M   0% /dev
tmpfs            48M  824K   47M   2% /run
host9p          256G  421M  256G   1% /
tmpfs           238M     0  238M   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
/dev/loop0       55M   21M   31M  40% /mnt/data
student@vulntech:~$ df -h /mnt/data
Filesystem      Size  Used Avail Use% Mounted on
/dev/loop0       55M   21M   31M  40% /mnt/data

A filesystem can also run out of inodes — the slots that hold file metadata — even with space left, if it has a huge number of tiny files. df -i shows inode use:

df -ih /mnt/data

In the terminal

student@vulntech:~$ df -ih /mnt/data
Filesystem     Inodes IUsed IFree IUse% Mounted on
/dev/loop0        16K    11   16K    1% /mnt/data

What's using the space? du

df tells you a filesystem is full; du (disk usage) tells you what's filling it. du -sh DIR gives one summary total for a directory:

du -sh /usr /var /etc

In the terminal

student@vulntech:~$ du -sh /usr /var /etc
384M	/usr
du: cannot read directory '/var/cache/ldconfig': Permission denied
du: cannot read directory '/var/cache/private': Permission denied
du: cannot read directory '/var/lib/private': Permission denied
du: cannot read directory '/var/log/private': Permission denied
du: cannot read directory '/var/tmp/systemd-private-75eddf5ebb3343ad84591ab928a37ebf-systemd-logind.service-fWAOTc': Permission denied
7.5M	/var
du: cannot read directory '/etc/ssl/private': Permission denied
911K	/etc

Finding the biggest directories

To hunt down space, list a directory's children with du -h, sort them by size with sort -h (which understands K/M/G), and keep the last few — the biggest:

du -h /usr/share | sort -h | tail -6

In the terminal

student@vulntech:~$ du -h /usr/share | sort -h | tail -6
1.4M	/usr/share/bash-completion
1.5M	/usr/share/groff
1.5M	/usr/share/groff/1.22.4
1.7M	/usr/share/zoneinfo
3.0M	/usr/share/terminfo
9.0M	/usr/share

Tip: df measures free space per filesystem; du adds up the files in a directory. They can disagree when a deleted file is still open — its space is gone from df but du can no longer see the file.

Remember: df -h shows how full each filesystem is (-i for inodes). du -sh DIR totals a directory's size; du -h DIR | sort -h | tail finds the biggest space-eaters.