EMZETT.
Login

Emzett Wiki

Analysing disk space on Linux: df, du and ncdu

Properties1
tagsglossar, linux, wartung

2 min read

Analysing disk space on Linux: df, du and ncdu

In short: With df you see which drives are how full, with du and ncdu which folders use the space; inodes, logs and Docker data also fill disks unnoticed.

In more detail: No space left on device has several causes: disk full, inodes exhausted, deleted but still open files, Docker/logs. Searching systematically saves time.

In Depth

df: where is space?

df -h            # size, used, free, mount point
df -i            # inodes (number of possible files)
df -hT           # with file system type

Use% at 100 % = full. Mind reserved blocks on ext4 (5 % for root). Inodes full (IUse% 100%) with millions of small files (mail queue, cache).

du and ncdu: what uses space?

du -h --max-depth=1 /var | sort -h      # folders by size
du -sh *                                # current level
ncdu /                                  # interactive (arrow keys, d to delete)
sudo find / -xdev -type f -size +500M 2>/dev/null

-x/--one-file-system prevents descending into other drives. ncdu is the most convenient. GUI: Baobab, Filelight.

Common space hogs

  • /var/log (logs), journalctl --disk-usage and sudo journalctl --vacuum-size=200M.
  • Package cache: sudo apt clean, apt autoremove, old kernels; dnf clean all.
  • Docker: docker system df, docker system prune (careful), images/volumes.
  • Snap/Flatpak: old revisions, flatpak uninstall --unused.
  • Home: downloads, ~/.cache, browser caches, trash (~/.local/share/Trash).
  • Backups/snapshots (Timeshift, Btrfs snapshots).
  • Core dumps (/var/lib/systemd/coredump).
  • Deleted but open: sudo lsof +L1: restart the process, then space is free.

Preventing

Log rotation (logrotate), limits for journal and Docker logs (max-size), monitoring (alarm at 80 % usage), separate partitions for /var or data, regular tidying, quotas for users. Before deleting check what the file is; never blindly rm -rf in system folders. To grow: extend LVM or enlarge the volume (resize2fs, xfs_growfs).

See also: Inodes, Freeing up storage space, Logs and scheduling, Partitions, LVM and LUKS

Backlinks