Monitoring Disk Space in Linux: Commands and Practices

Introduction / Why This Matters

Continuous monitoring of disk space is a critically important task for any system administrator or developer working with servers. Disk fill-ups lead to service outages, log write errors, and complete system failure. This guide will help you not only diagnose the problem but also prevent it by mastering essential Linux tools for analyzing disk usage at the file and directory level. You'll learn how to quickly find space hogs and make informed decisions about cleanup.

Prerequisites / Preparation

Before you begin, ensure:

1. You have access to a Linux terminal (via SSH or locally).
2. You have sudo (administrator) privileges to analyze system directories (/var, /home, /usr) and use ncdu/lsof.
3. Your distribution is based on Debian/Ubuntu or RHEL/CentOS/Fedora (commands are universal, but package names may differ).
4. You know which specific partition (/, /home, /var) has filled up. If not, start with Step 1.

Step 1: Quick Overview of All Partitions

First, get the overall picture. The df (disk free) command shows usage of filesystems/partitions.

df -h

Example output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   45G  3.1G  94% /
/dev/sda2       200G  150G   45G  77% /home
/dev/sda3        20G   18G  1.5G  93% /var

What to look for:

• Use% — usage percentage. Target candidates for cleanup are partitions with >85%.
• Mounted on — the mount point. This is where you need to "dive into" for detailed analysis.

Step 2: Detailed Analysis of the Problem Partition with du

The du (disk usage) command estimates usage of directories. It's slower than df but provides detail.

Rule: Analyze from the bottom up. Start with a top-level overview, then drill down.

# 1. Change to the root of the problem partition (e.g., /var)
cd /var

# 2. Show the size of each item in the current directory in human-readable format (-h)
#    Sort by descending size (-r) and output only the top 20
sudo du -sh * 2>/dev/null | sort -rh | head -n 20

Key flags:

• -s — summary size for each argument.
• -h — human-readable (K, M, G).
• 2>/dev/null — suppress "Permission denied" errors.

Example output:

4.2G    log
3.8G    cache
1.2G    lib
...

You see that /var/log is the main space hog. Now you need to drill into it.

Step 3: Interactive Analysis with ncdu (Recommended)

For convenience, install ncdu (NCurses Disk Usage). It's an interactive text-based disk usage browser.

# Installation (Debian/Ubuntu)
sudo apt update && sudo apt install ncdu

# Installation (RHEL/CentOS 8+)
sudo dnf install ncdu

# Run to analyze the /var partition
sudo ncdu /var

How to navigate in ncdu:

• Arrow keys ↑/↓ — navigation.
• Enter — enter a directory.
• d — delete selected file/directory (will prompt for confirmation!).
• q — quit.
• Press ? for full help.

ncdu automatically scans the selected directory and shows the percentage relative to total size, which is very intuitive.

Step 4: Finding Specific Large Files

Sometimes the problem isn't directories but one or two huge files (e.g., a database dump, years-old logs, a forgotten archive).

# Find files larger than 100MB in /var/log and output top 10 by size
sudo find /var/log -type f -size +100M -exec du -h {} + 2>/dev/null | sort -rh | head -n 10

# Faster variant (only name and size, without du)
sudo find /var/log -type f -size +100M -exec ls -lh {} + | awk '{ print $5, $9 }' | sort -rh | head -n 10

To search the entire partition (can be slow):

sudo find /var -type f -size +500M 2>/dev/null

Step 5: Finding "Orphaned" Deleted Files

Scenario: You deleted a large file with rm, but space was not freed. This happens if a process still holds an open file descriptor to the deleted file.

# Show all open deleted (deleted) files in the system
sudo lsof | grep '(deleted)'

# Example output:
# COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
# java     1234   app    rtd    REG    8,2   10.0G 123456 /var/log/app.log (deleted)

Solution: Restart the process (PID 1234 in the example). The space will be freed after that.

Step 6: Checking Package Manager Cache Space

For Debian/Ubuntu:

sudo apt clean        # Removes all cached .deb files from /var/cache/apt/archives
sudo apt autoremove   # Removes automatically installed dependencies that are no longer needed

For RHEL/CentOS/Fedora:

sudo yum clean all    # Cleans all yum/dnf cache
sudo package-cleanup --leaves  # Shows "orphaned" packages (requires yum-utils)

Important: Do not run clean on a production server without understanding the consequences. It speeds up future updates but may require reinstalling packages.

Verifying the Result

After performing cleanup actions, return to Step 1 and run df -h again. Ensure the Use% for the problem partition has dropped to a safe level (recommended <80%).

You can also check the change in a specific directory:

du -sh /var/log

Potential Issues

1. du shows less than df?
   • Cause: Files that are deleted but still open by processes (see Step 5). Or using du without sudo (you don't see other users' files).
   • Solution: Use sudo du and look for "deleted" files via lsof.
2. ncdu/find hangs or is very slow?
   • Cause: Analyzing a huge number of small files (e.g., /proc, /sys, network filesystems).
   • Solution: Always specify a specific path for analysis (ncdu /var), not the root /. Exclude mounted filesystems with the -x flag (sudo du -shx /).
3. Cannot delete a file from ncdu or rm — "Permission denied"
   • Cause: File belongs to another user or a system process.
   • Solution: Use sudo to delete (sudo rm path/to/file). Be careful!
4. Log cleanup didn't help — space returned within a day
   • Cause: The application continues writing logs uncontrollably. Did a single file grow or did new files appear?
   • Solution: Configure log rotation (logrotate) for the problematic application. Find the config in /etc/logrotate.d/ or configure it within the application itself.