Linux Disk Space Monitoring: A Complete Guide

Introduction / Why This Is Needed

Hello! If you administer a Linux server or even just work on a workstation, you've certainly encountered a situation where a disk suddenly fills up. This leads to service outages, write errors, and even complete system failure. Regular monitoring of disk space is not just a good practice, but a necessity for system stability.

In this guide, you will learn how to quickly assess the disk space situation, find "space eaters," and set up automatic alerts for critical capacity using built-in utilities (df, du) and a convenient third-party tool (ncdu). All instructions work on most modern distributions.

Requirements / Preparation

Before you begin, make sure you have:

1. Terminal access — locally or via SSH.
2. Basic command-line skills — ability to enter commands and read output.
3. Superuser (sudo) privileges — for analyzing system directories (/var, /usr) and installing packages. Some du commands without sudo may return "Permission denied" errors.

💡 Tip: If you are working on a server, always test commands on a test directory before running them in system folders.

Step-by-Step Instructions

Step 1: Check Overall Disk Usage with df

The df (disk free) command is your first tool. It shows free and used space on all mounted filesystems.

df -h

The -h (human-readable) flag converts sizes to kilobytes, megabytes, or gigabytes for easier reading.

Example output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   45G  3.5G  93% /
tmpfs           1.9G  1.2M  1.9G   1% /dev
/dev/sdb1       200G   30G  160G  16% /home

What to watch for:

• Use% — usage percentage. Values above 80% are cause for concern.
• Mounted on — mount point. Pay attention to the root (/) and service (/var, /tmp) filesystems.

⚠️ Important: df shows usage of the entire partition, including system files, caches, etc. To understand what exactly is consuming space within a partition, move on to du.

Step 2: Analyze Usage of Specific Directories with du

The du (disk usage) command estimates the size of files and directories in the current or specified filesystem.

Basic example:

du -sh /var

• -s (summarize) — show only the total size, not for each subdirectory.
• -h — human-readable format.
• Result: 4.2G /var

Find the largest folders in the current directory:

du -sh * 2>/dev/null | sort -rh | head -n 10

• * — all files/folders in the current directory.
• 2>/dev/null — suppress "Permission denied" errors.
• sort -rh — sort by descending numerical value (accounting for G, M suffixes).
• head -n 10 — show top 10.

Recursive analysis with depth:

du -h --max-depth=2 / 2>/dev/null | sort -rh | head -n 20

This will show all directories in the root (/) with a nesting depth of 2 levels and output the top 20 by size.

💡 Tip: Always add 2>/dev/null when analyzing system directories to avoid access errors.

Step 3: Install and Use ncdu for Interactive Analysis

ncdu (NCurses Disk Usage) is an interactive utility that dramatically simplifies finding large files. It shows a tree structure with sizes and allows you to delete files directly from the interface.

Installation:

• Debian/Ubuntu:

  sudo apt update && sudo apt install ncdu
  

• RHEL/CentOS/Fedora:

  sudo yum install ncdu   # or dnf on Fedora
  

• Arch Linux:

  sudo pacman -S ncdu
  

Usage:

ncdu /path/to/directory

For example, ncdu / to analyze the entire root (may take a few minutes).

Controls in ncdu:

• Arrow keys ↑/↓ — navigate.
• Enter — enter a folder.
• d — delete selected file/folder (with confirmation).
• q — quit.
• ? — help.

The interface immediately shows which folders are "eating" the most space and allows you to quickly clean up space.

Step 4: Set Up Automatic Monitoring via cron

Let's configure a script that will check disk usage every hour and send a notification if it exceeds 90%.

Create the script:

sudo nano /usr/local/bin/disk-monitor.sh

Paste the following code:

#!/bin/bash
# Disk space monitoring script
THRESHOLD=90
EMAIL="admin@example.com"  # Replace with your email
HOSTNAME=$(hostname)

# Get usage for the root partition (can add others)
USAGE=$(df / | awk 'NR==2 {print $5}' | sed 's/%//')

if [ "$USAGE" -ge "$THRESHOLD" ]; then
    echo "WARNING: Disk space on $HOSTNAME is $USAGE% full (threshold: $THRESHOLD%)." | \
    mail -s "Critical disk usage on $HOSTNAME" $EMAIL
fi

Explanation:

• df / — gets the line for root.
• awk 'NR==2 {print $5}' — takes the 5th column (usage percentage) from the second line.
• sed 's/%//' — removes the % character.
• mail — sends email. Ensure mailutils is installed (sudo apt install mailutils).

Make the script executable:

sudo chmod +x /usr/local/bin/disk-monitor.sh

Add to cron:

sudo crontab -e

Add the line (run every hour):

0 * * * * /usr/local/bin/disk-monitor.sh

Save and exit. The script will now check the disk automatically.

💡 Tip: For testing, temporarily lower THRESHOLD to 5% and wait for the next hour or run the script manually.

Step 5: Use Graphical Utilities (for Desktops)

If you work in a graphical environment (GNOME, KDE, XFCE), there are convenient visual tools:

• Disk Usage Analyzer (baobab) — comes with GNOME. Shows circular and tree diagrams.

  baobab /home
  

• Filelight — for KDE, displays usage as concentric circles.

  sudo apt install filelight  # Debian/Ubuntu
  filelight ~
  

• QDirStat — cross-platform, shows not only size but also file count.

Install via your package manager and launch from the applications menu or terminal.

Verification

1. For df and du: Run the commands and ensure the output matches expectations. For example, df -h should show current usage.
2. For ncdu: Run on a test directory (e.g., ~/Downloads) and check that the interface displays files and folders.
3. For automatic monitoring:
   • Run the script manually: sudo /usr/local/bin/disk-monitor.sh
   • Check email (or logs if email is not configured).
   • View system log entries: grep disk-monitor /var/log/syslog (or journalctl).

If everything works, you have successfully set up monitoring!

Possible Issues

1. "Permission denied" errors when using du

Cause: No read permissions for certain system directories. Solution: Run du with sudo (carefully!) or use 2>/dev/null to suppress errors. For a complete picture, run sudo du -sh /var (only if you know what you're doing).

2. du shows more space than df

Cause:

• Deleted but still open-by-process files (e.g., logs you deleted but a process is still writing to). They occupy disk space but are not visible in ls.
• Reserved space for root (usually 5% in ext4), which du does not account for. Solution: Find such files:

sudo lsof | grep deleted

Terminate the process or copy the file, then restart the service.

3. ncdu runs very slowly on large filesystems

Cause: Analyzing millions of files takes time. Solution: Limit analysis to a specific directory (not /), or use --exclude to skip caches (e.g., ncdu --exclude /proc --exclude /sys /).

4. Automatic script does not send email

Cause: MTA (mail transfer agent) not configured or incorrect email. Solution:

• Install mailutils and configure a local MTA (e.g., postfix).
• For testing, send an email manually: echo "test" | mail -s "test" you@example.com.
• Verify the script runs as root (via sudo crontab -e).

5. Symbolic links and du

Cause: By default, du does not follow symbolic links, but using -L can cause loops. Solution: Avoid -L when analyzing system directories. For specific cases, use du -L with caution.

Now you are armed with the knowledge to never be caught off guard by a full disk. Regular monitoring is a small amount of work that saves you from big problems. Good luck with your administration!