Disk Usage Cheat Sheet: du, df, ncdu and lsblk

df -h                                  # free space on every filesystem
df -h /home                            # the filesystem that holds /home
du -sh ~/Downloads                     # total size of one folder
sudo du -xh --max-depth=1 / | sort -h  # biggest top-level dirs on /
sudo ncdu -x /                         # interactive browser
df -i                                  # inode usage ("full" with free space?)

df asks each filesystem how full it is. du walks a directory tree and adds up file sizes. Use df to learn which filesystem is full and du (or ncdu) to learn what is filling it. If you are already seeing write failures, follow No space left on device for the full recovery steps.

df: free space per filesystem

Example output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p2  468G  441G  3.6G 100% /
/dev/nvme0n1p1  1.1G   71M  1.0G   7% /boot/efi
tmpfs           3.9G  2.1M  3.9G   1% /tmp

Size minus Used is larger than Avail on ext4 because about 5% is reserved for root by default. That is why a "100%" disk still lets root log in and clean up.

du: size of files and directories

ncdu and other analyzers

Disks, partitions and mounts

Partitioning, resizing and fstab are covered in the disk management guide.

Common recipes

Find the directory that is filling the root filesystem, one level at a time:

sudo du -xh --max-depth=1 / 2>/dev/null | sort -h | tail -8
sudo du -xh --max-depth=1 /var 2>/dev/null | sort -h | tail -8

List the biggest files on a filesystem (more options in the find largest files script):

sudo find / -xdev -type f -size +500M -printf '%s\t%p\n' 2>/dev/null | sort -rn | head -20 | numfmt --field=1 --to=iec

Space is used but you cannot find the files: look for deleted files still held open:

sudo lsof +L1
# restart the process holding them, for example:
sudo systemctl restart rsyslog

Shrink the systemd journal (see the journalctl cheat sheet):

journalctl --disk-usage
sudo journalctl --vacuum-size=500M

Clean package caches:

sudo apt clean && sudo apt autoremove --purge     # Debian, Ubuntu, Mint
sudo dnf clean all && sudo dnf autoremove          # Fedora
sudo paccache -rk2                                # Arch (pacman-contrib), keep 2 versions
sudo zypper clean --all                           # openSUSE

Find old disabled snap revisions and Flatpak leftovers:

snap list --all | awk '/disabled/{print $1, $3}'
flatpak uninstall --unused

Check the size of Docker data:

docker system df
docker system prune     # removes stopped containers, unused networks, dangling images

Gotchas

• du and df disagree. Open deleted files, reserved blocks, snapshots (Btrfs, LVM) and files hidden under a mount point all count for df but not du. To see files hidden under a mount point, bind-mount the parent: sudo mount --bind / /mnt and run du on /mnt.
• Forgetting -x. du / without -x walks /proc, network shares and every other disk, takes ages and gives a meaningless total.
• du -sh * skips dotfiles. In a home directory most space is often in .cache, .local/share or .var/app (Flatpak).
• Inodes can run out first. Millions of tiny files (mail queues, session files, node_modules) give "No space left on device" with free bytes. Check df -i.
• Do not delete active logs with rm. The process keeps writing to the deleted file and the space is not freed. Truncate instead: sudo truncate -s 0 /var/log/big.log.
• Units. -h means 1024-based (GiB, shown as G); drive makers use 1000-based. A "500 GB" SSD shows as about 466G.

Option references: du(1), df(1) and lsblk(8).

Frequently asked questions