Disk space: df, du, inode

Q: df says "full", but du can't find that much

A file was deleted but is still open by a process — the space isn't freed until it closes: sudo lsof +L1 # files with 0 links but still open (see lsof) Restart the process holding it (often a log that got rotated incorrectly).

Q: No space left on device, even though df -h shows free space

You're out of inodes: df -i. Find the directory full of tiny files and clean it up: for d in /*; do printf '%8s %s\n' "$(find "$d" -xdev 2>/dev/null | wc -l)" "$d"; done | sort -rn

Q: Logs filled up the disk

du -sh /var/log/*; set up rotation (logrotate) and the journal (journalctl --vacuum-time=, see journalctl).

Q: Deleted files, but the space didn't come back

Either a deleted-but-open file (see lsof +L1 above), or it's a different partition — check df -h path.

4 min Linux

Where the space and inodes went — df, du, finding large files, pitfalls.

Cheat sheet

7 commands Printable version

df -h free space per partition
df -i free inodes per partition
du -xh --max-depth=1 / | sort -h top directories (within one filesystem)
ncdu / interactive overview
sudo lsof +L1 deleted-but-open files
sudo journalctl --vacuum-time=7d trim the system journal
sudo apt clean clear the package cache

Overview

Two independent reasons for "disk full":

you ran out of space (bytes) — check with df -h;
you ran out of **inode**s (the numeric "slots" for files) — check with df -i. This happens with millions of small files; there's space, but you can't create a file.

The approach: df -h and df -i → find the partition → du/ncdu top-down to the culprit.

Recipes

df / du / ncdu

bash

df -h                             # free space by partition (human-readable)
df -i                             # free inodes by partition
df -h /var                        # a specific path (which partition it's on)
df -hT                            # + filesystem type

du -sh /var/*                     # size of each subdirectory of /var
du -h --max-depth=1 / | sort -h   # top "heavy" top-level directories
du -xh --max-depth=1 /            # -x: stay within one filesystem (skip /proc, mounts)
du -sh /var/log                   # how much space logs take up
ncdu /                            # interactive overview (the most convenient; apt install ncdu)

ls -lhS | head                    # the largest files in a directory
find / -xdev -type f -size +500M -exec ls -lh {} + 2>/dev/null   # files over 500 MB

-x/-xdev is the key to a clean result: count only the current filesystem, without descending into mounted and virtual ones (/proc, /sys).

What to clean up

bash

sudo journalctl --vacuum-time=7d  # trim the system journal to 7 days
sudo journalctl --disk-usage      # how much space the journal takes up
sudo apt clean                    # cache of downloaded packages
sudo apt autoremove --purge       # old kernels and dependencies
docker system df ; docker system prune -af   # docker images/layers (often huge)
du -sh ~/.cache/*                 # per-user caches

Troubleshooting

df says "full", but du can't find that much

A file was deleted but is still open by a process — the space isn't freed until it closes:

bash

sudo lsof +L1                     # files with 0 links but still open (see lsof)

Restart the process holding it (often a log that got rotated incorrectly).

No space left on device, even though `df -h` shows free space

You're out of inodes: df -i. Find the directory full of tiny files and clean it up:

bash

for d in /*; do printf '%8s %s\n' "$(find "$d" -xdev 2>/dev/null | wc -l)" "$d"; done | sort -rn

Logs filled up the disk

du -sh /var/log/*; set up rotation (logrotate) and the journal (journalctl --vacuum-time=, see journalctl).

Deleted files, but the space didn't come back

Either a deleted-but-open file (see lsof +L1 above), or it's a different partition — check df -h path.

Terms

inode: A filesystem structure containing object metadata; its name is stored separately in a directory entry. Also appears in: Symbolic and hard links, ln, mkfs, /proc: processes and the kernel as files and 14 more
apparent size: A file size in bytes including sparse holes; it can differ from allocated space.
sparse file: A file with logical regions lacking allocated data blocks; reading those holes returns zeroes. Also appears in: stat

Overview

Recipes

df / du / ncdu

What to clean up

Troubleshooting

df says "full", but du can't find that much

No space left on device, even though df -h shows free space

Logs filled up the disk

Deleted files, but the space didn't come back

Terms

See also

No space left on device, even though `df -h` shows free space