In Linux and Unix-like operating systems, managing system storage requires a clear understanding of your file system layout and directory structures. When a server runs out of disk space, applications can crash, databases can become corrupted, and deployment pipelines will fail. To diagnose and resolve these storage issues, systems engineers rely on two fundamental command-line utilities: df (disk free) and du (disk usage).
While both commands measure storage space, they approach the task from completely different angles.
1. Analyzing File Systems Globally with the df Command
The df utility examines storage at the file system level. It queries the operating system's kernel to get an immediate, high-level overview of how much space is allocated, used, and remaining across all mounted drives, virtual file systems, and network storage volumes.
- Standard Usage: Running the command as
df -h is the most common approach. The -h flag converts raw block counts into a human-readable format, displaying sizes in Gigabytes (G) or Megabytes (M) instead of raw bytes.
- Identifying Storage Outages: The output shows the total size, used space, available space, and a use percentage for each mounted path. If the
Use% column hits 100% on a critical mount point like the root directory (/) or the data partition (/var), system operations will stall.
- Tracking Inode Exhaustion: A file system can run out of space even if it has hundreds of gigabytes of storage left. This happens when the drive runs out of Inodes (index nodes), which are the metadata entries used to track individual files. Running
df -i allows you to monitor your Inode utilization percentage directly.
2. Inspecting Specific Directories with the du Command
While df tells you which file system is full, it cannot tell you why it is full. To find the specific directories, large logs, or bloated user files causing the issue, you must use the du command. This tool traverses the directory tree recursively, adding up the actual space used by every individual file it encounters.
- Targeted Directory Analysis: Running
du -sh /var/log provides a quick, human-readable summary (-s) of the total space consumed by that specific directory without listing every single log file inside it.
- Finding the Largest Files: To hunt down space-wasting directories, engineers often run a sorted command like
du -h --max-depth=1 /path or pipe the output into the sort utility: du -ah /var | sort -rh | head -n 10. This surfaces the top ten largest files or folders instantly.
- Appreciating the Speed Difference: Because
du must scan every single file on the drive one by one, running it across massive directory structures can take a noticeable amount of time and create heavy storage read operations. In contrast, df reads instant summaries from the system kernel instantly.
Why df and du Discrepancies Happen
A common point of confusion occurs when df shows a file system is completely full, but running du across that same drive suggests plenty of space remains. This mismatch happens because of how Linux handles deleted files.
If an active application (like an enterprise web server or database engine) keeps a large log file open while an engineer deletes it via the command line, the file name disappears from the directory structure, making it invisible to du. However, the Linux kernel refuses to actually free up that storage space until the application holding the file open closes it or restarts. To find these hidden, unlinked files, you can run lsof +L1 or lsof | grep deleted, which shows you exactly which active processes are trapping deleted data in memory. Restarting that specific service will clear the lock and instantly free up your storage space.