df, du & duf — Disk Usage#

df — Disk Free (filesystem summary)#

df reports the amount of disk space used and available on every mounted filesystem.

Common flags#

df -h                    # all mounts, human-readable
df -hT                   # include filesystem type
df -h /home              # specific mount point
df -h /dev/sda1          # specific device
df -i                    # inode usage (when "no space" but df -h looks fine)
df -h -t ext4            # only ext4 filesystems
df -h -x tmpfs -x devtmpfs  # skip tmpfs/devtmpfs
df -h --total            # with grand total

Interpreting output#

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   18G   30G  38% /
tmpfs           2.0G  100M  1.9G   5% /dev/shm

• Use% above ~85% → time to investigate or expand
• Avail = 0 with non-zero Used → filesystem full

# Alert when any filesystem exceeds 90%
df -h | awk 'NR>1 && $5+0 > 90 {print "WARN:", $6, "is", $5, "full"}'

du — Disk Usage (per directory/file)#

du estimates file space usage — the sum of blocks used by each file.

Common flags#

du -sh *                  # size of each item in cwd
du -sh /var/log           # total size of /var/log
du -sh ~/Downloads/*      # size of each download
du -h --max-depth=1 /     # one level deep from root
du -h -d 2 /home          # two levels from /home
du -ahc /etc/*.conf       # all .conf files + total

# Sort by size (largest first)
du -sh * | sort -rh | head -20

# Find the biggest directories anywhere under /var
du -h /var | sort -rh | head -20

# Exclude patterns
du -sh --exclude=".git" --exclude="node_modules" .

Find what’s eating space#

# Step-by-step drill-down
du -h --max-depth=1 /         # find big top-level dirs
du -h --max-depth=1 /var      # drill into /var
du -h --max-depth=1 /var/log  # drill into logs

# Top 20 largest files anywhere on the filesystem
find / -xdev -type f -printf '%s\t%p\n' 2>/dev/null \
  | sort -rn | numfmt --to=iec-i --suffix=B --field=1 | head -20

# Largest files under current dir
du -ah . | sort -rh | head -20

Watch for growth#

# Compare directory size over time
du -sh /var/log > /tmp/before.txt
sleep 3600
du -sh /var/log > /tmp/after.txt
diff /tmp/before.txt /tmp/after.txt

duf — Disk Usage/Free Utility#

duf is a modern, colourful replacement for df with better layout and filtering.

Installation#

sudo apt install duf        # Debian/Ubuntu (20.10+)
brew install duf            # macOS
scoop install duf           # Windows
# or download from: github.com/muesli/duf

Usage#

duf                         # all mounts, colourful table
duf /home /tmp              # specific paths
duf --only local            # only local filesystems
duf --only network          # only network mounts
duf --only fuse             # only FUSE mounts
duf --hide-fs tmpfs,devtmpfs  # hide specific filesystem types
duf --inodes                # show inode usage
duf --output mountpoint,size,used,avail,usage  # custom columns
duf --sort size             # sort by size
duf --sort usage            # sort by usage %
duf --json                  # machine-readable JSON
duf --theme light           # light theme
duf --no-color              # disable colour
duf --width 100             # set terminal width
duf --all                   # include special/pseudo filesystems

Available columns for --output#

mountpoint, size, used, avail, usage, type, filesystem, inodes, inodes_used, inodes_avail, inodes_usage

Combining them#

# Full disk health check
echo "=== Filesystem Usage ===" && df -hT
echo "=== Top Dirs Under /var ===" && du -h --max-depth=2 /var | sort -rh | head -10
echo "=== Inode Usage ===" && df -i | awk '$5+0 > 50'

# Find and delete old core dumps eating space
find / -xdev -name "core" -type f -size +100M -print0 | xargs -0 ls -lh

[!TIP] When df -h shows a filesystem full but du -sh doesn’t account for all the space, look for deleted but open files: lsof | grep deleted | awk '{print $7, $NF}' | sort -rh | head -10. A running process may hold file descriptors to deleted log files, keeping the blocks allocated.