Linux Disk Management: Complete Guide to df, du, and Storage Tools
Learn to monitor disk usage, find space hogs, and manage storage with practical Linux commands. From quick checks with df to deep analysis with ncdu, master the tools that keep your systems running smoothly.
Why Disk Management Is Critical for Linux Users
Disk management is the difference between a smooth-running Linux system and unexpected crashes, failed deployments, and data loss. When disk space runs out, services stop writing logs, databases can't commit transactions, and applications fail in unpredictable ways.
Every Linux administrator, developer, and power user faces disk management challenges. Application logs grow silently in /var/log. Docker images accumulate in /var/lib/docker. User home directories fill with forgotten downloads and cache files. Without regular monitoring, systems reach 100% capacity without warning.
The tools covered here - df, du, ncdu, find, and lsblk - give you visibility into your storage. You'll learn to quickly check available space, identify which directories consume the most storage, find large files worth investigating, and understand filesystem mount points and partitions.
These aren't just commands to memorize - they're tools that solve real problems. Learn them once, use them for your entire Linux career. They work identically across all major distributions and have saved countless systems from disk-full disasters.
Common Disk Management Mistakes
Only Checking When Disk Is Full
The Problem: Waiting until 100% disk usage causes application failures, database corruption, and system instability. Services crash when they can't write logs or temp files.
The Solution: Monitor disk usage proactively with df -h weekly. Set up alerts at 80% usage. Use ncdu monthly to identify growth trends. The Practical Linux Handbook covers monitoring automation and alerting strategies.
Deleting Files Without Understanding Impact
The Problem: Removing files in /var or /usr without knowing their purpose can break applications and system services. Deleted log files might be needed for troubleshooting.
The Solution: Use du and find to identify large files first. Research unfamiliar files before deletion. Compress old logs instead of deleting: gzip *.log. Learn safe cleanup targets in the handbook's system administration chapters.
Ignoring Inode Exhaustion
The Problem: Disks can show available space but fail to create files when inodes (file metadata slots) are exhausted. Common with many small files like logs or cache.
The Solution: Check inodes with df -hi regularly. High inode usage appears with millions of small files. Clean up /tmp and cache directories with many tiny files. The book explains filesystem internals including inode limits.
Not Using Human-Readable Output
The Problem: Raw numbers in bytes are hard to interpret quickly. Seeing '67108864' doesn't immediately register as 64MB, slowing down decision-making during disk emergencies.
The Solution: Always use -h flag with df, du, and ls commands for GB/MB/KB output. Add alias du='du -h' and alias df='df -h' to your ~/.bashrc. Master output formatting tricks in the terminal productivity chapter.
5 Essential Disk Management Commands
Each command includes syntax, purpose, practical examples, and real-world use cases. These aren't just commands to memorize - they're tools that solve actual problems.
df - Check Disk Space and Filesystem Usage
Syntax: df [options]
df (disk free) shows available disk space on mounted filesystems. Essential for monitoring storage capacity and preventing out-of-space errors. Use -h for human-readable sizes, -T to show filesystem types, and -i to check inode usage.
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 100G 65G 30G 69% /
/dev/sdb1 500G 380G 120G 76% /home
$ df -hT # Show filesystem types
$ df -hi # Check inode usageWhen to use: Watch for 100% usage which causes failures. Monitor /var/log for log files filling up. Check inodes with -i when disk shows space but can't create files. Set up monitoring alerts at 80% usage.
du - Analyze Disk Usage by Directory
Syntax: du [options] [directory]
du (disk usage) shows how much space directories and files consume. Perfect for finding what's using disk space and identifying cleanup targets. Use -h for human-readable sizes, -s for summary totals, and --max-depth to limit recursion.
$ du -sh .
2.4G .
$ du -h --max-depth=1 /home
1.2G /home/user1
856M /home/user2
$ du -h /var | sort -rh | head -10When to use: Combine with sort -rh to find largest items first. Use --max-depth=1 to avoid overwhelming output. Check /var/log and /tmp regularly for cleanup opportunities.
ncdu - Interactive Disk Usage Analyzer
Syntax: ncdu [directory]
ncdu (NCurses Disk Usage) provides an interactive, visual interface for exploring disk usage. Navigate directories with arrow keys, identify large files, and delete directly from the interface. Install with: sudo apt install ncdu
$ ncdu /home
# Navigation:
# Arrow keys: Move between items
# Enter: Open directory
# d: Delete selected item
# n: Sort by name
# s: Sort by size
$ sudo ncdu / # Analyze entire systemWhen to use: Use ncdu for interactive exploration, df/du for scripts. Press '?' for help inside ncdu. Be careful with 'd' delete key - there's no undo. Save snapshots with -o to track growth over time.
find - Find and Clean Large Files
Syntax: find [path] -type f -size [size]
Use find command with -size option to locate large files consuming disk space. Essential for cleanup and space recovery. Combine with -exec to take action on found files. Sizes: c (bytes), k (KB), M (MB), G (GB).
$ find /home -type f -size +100M
$ find /var/log -type f -size +50M -exec ls -lh {} \;
$ find ~/ -type f -exec du -h {} + | sort -rh | head -20
$ find ~/.cache -type f -atime +90 -deleteWhen to use: Always use -exec ls first to preview before deleting. Check /var/log, ~/.cache, /tmp regularly. Use -mtime to target old files. Compress old logs instead of deleting: gzip large.log.
lsblk - List Block Devices and Partitions
Syntax: lsblk [options]
lsblk lists all block devices (disks and partitions) in a tree format. Shows device names, sizes, types, and mount points. Essential for understanding disk layout before making storage changes. Use -f to show filesystems and UUIDs.
$ lsblk
NAME SIZE TYPE MOUNTPOINT
sda 500G disk
├─sda1 50G part /
└─sda2 450G part /home
$ lsblk -f # Show filesystems and UUIDs
$ sudo fdisk -l # View partition tablesWhen to use: Use lsblk to get overview before making changes. Always unmount before physically removing drives. Edit /etc/fstab carefully - errors prevent boot. Use UUID instead of /dev/sdX in fstab (more reliable).
Your First Steps to Disk Management Mastery
Knowledge without practice is useless. Follow this simple 3-step plan to build real disk management skills this week.
Check Your Current Disk Usage
Run df -h to see overall filesystem usage and du -sh /* to see top-level directory sizes. Identify filesystems above 70% usage. This gives you a baseline understanding of your storage situation.
Install and Use ncdu
Install ncdu (sudo apt install ncdu or sudo dnf install ncdu) and explore your filesystems interactively. Start with ncdu /home to find your largest directories. Navigate with arrow keys and press '?' for help.
Find and Clean Large Files
Search for files over 100MB with find, review the results, and clean up unnecessary downloads, logs, or cache files. Use find ~/ -type f -size +100M -exec ls -lh {} \; to preview, then decide what to remove.
Master Disk Management and 30+ Other Linux Topics
The Practical Linux Handbook covers disk management in depth, along with essential commands, file operations, permissions, networking, and system administration. Learn the skills professional Linux users rely on every day.
du vs df: What's the Difference?
New Linux users often confuse these two commands. They answer different questions and should be used together, not interchangeably.
df — disk free
Answers: “How much space is left on the filesystem?”
Filesystem level — reports what the OS has allocated and what remains on each mounted partition.
df -hHuman-readable sizes (KB/MB/GB)df -hTInclude filesystem type (ext4, xfs…)df -hiCheck inode usage instead of block usagedf -h /homeCheck a specific mount pointUse when: Quick sanity check. First command to run when you suspect a disk is full.
du — disk usage
Answers: “What is using this disk space?”
Directory/file level — scans actual files and sums their sizes to show where space is consumed.
du -sh /varTotal size of /var as one numberdu -h --max-depth=1 /Size of each top-level directorydu -h | sort -rh | headFind the biggest itemsdu -sh ~/.cacheCheck a specific directoryUse when: Investigation. After df shows a filesystem is full, use du to find what to delete.
Why can df and du disagree?
df reports space at the filesystem level including reserved blocks (typically 5% reserved for root). du only counts files it can read, so it misses reserved space and files held open by processes after deletion. A process can delete a log file but still hold it open — df sees the space as used, du does not. The canonical workflow: df -h to find the full filesystem, then du -h --max-depth=1 /that/mount | sort -rh to find the culprit.
Frequently Asked Questions
What's the difference between df and du, and when should I use each?
df shows filesystem-level space (what the operating system reports as available), while du calculates actual file sizes by scanning directories. Use df for quick overall status, du to investigate what's using space. They can differ because of reserved blocks and deleted-but-open files.
How do I find out which directory is using the most disk space?
Run: du -h --max-depth=1 /home | sort -rh | head -10. This shows top 10 directories by size under /home. Or use ncdu /home for interactive exploration. For system-wide: sudo du -h --max-depth=1 / | sort -rh.
What should I do when my disk is 100% full?
First, free immediate space: empty /tmp with sudo rm -rf /tmp/*, clean package cache (Ubuntu: sudo apt clean), remove old logs in /var/log. Then find large files: find / -type f -size +100M 2>/dev/null. Finally, investigate growth with ncdu to prevent recurrence.
Is it safe to delete files in /var/log to free up space?
Yes, but with caution. Old log files (*.log.1, *.gz) are generally safe to delete. Active log files (*.log without number) might be in use - truncate instead: sudo truncate -s 0 /var/log/syslog. Better: set up logrotate to manage logs automatically.
Why does df show space available but I still get 'disk full' errors?
Two common causes: (1) Inodes exhausted - check with df -hi. Millions of small files consume inodes. (2) Reserved blocks for root - filesystems reserve 5% for root. Regular users hit limits before root. Use sudo df to see root's view.
How can I automatically monitor disk usage and get alerts?
Create a cron job that runs df -h and sends email if usage exceeds threshold. Or use monitoring tools like Nagios, Prometheus, or Zabbix. Simple script: if [ $(df / | awk 'NR==2 {print $5}' | sed 's/%//') -gt 80 ]; then mail -s "Disk Alert" admin@example.com; fi. Add to cron for hourly checks.
Start Managing Disk Space Like a Pro
Join thousands who've learned to monitor, analyze, and optimize disk usage with The Practical Linux Handbook.