Check Disk Space with df and du: Differences and Usage

Ever found yourself staring at a “No space left on device” error, right in the middle of a deploy or backup? Or watched a Docker container go belly-up because the disk was full (again)? If yes, this post is for you. We’re diving deep into the magical world of disk space investigation with df and du, the two open-source command-line tools that should be in every server admin’s toolkit.

Table of Contents

• What Is This Article About and Why Should You Care?
• A Real-World Admin Horror Story
• Why Disk Space Management Is a Big Deal
• How Do df and du Work?
• Use Cases: When to Use df vs du (Comic Table!)
• Step-By-Step Guide: Checking Disk Space Like a Pro
• Mini Glossary (with Real-Talk Definitions)
• Examples & Stories: What to Do (and NOT to Do)
• Common Myths, Beginner Mistakes & Similar Tools
• “Use This If…” Decision Flowchart
• Automation, Scripting & Unusual Tricks
• Tales from the Trenches: The Curious Case of the Phantom Log
• Conclusion & Recommendations

What Is This Article About and Why Should You Care?

If you run a VPS, cloud instance, Docker host, or a beefy dedicated server, you need to stay on top of your disk usage. This article is your hands-on, no-nonsense guide to checking disk space fast and correctly using df and du — and understanding when to use which one. Whether you’re surviving a server crunch or just want to keep your next deployment drama-free, this guide has you covered.

A Real-World Admin Horror Story

Imagine: It’s 2AM. You’re rolling out a quick hotfix. Suddenly, the deploy script fails. “No space left on device.” You scramble. df -h says you’ve got 10GB free. The app is still down. What’s going on?! Turns out, a rogue log file in a Docker volume ate up every available inode. Your deploy fails, the logs are silent, and the client is calling. This is why knowing when and how to use df vs du is more than just a party trick.

Why Disk Space Management Is a Big Deal

• Downtime. Full disks can cause containers, VMs, even the entire host to go offline or crash in weird ways.
• Silent Failures. Many apps just stop writing logs or data, and you don’t notice until it’s too late.
• Performance. Disk nearly full? You’ll see I/O stalls, high load, and slow restarts.
• Security. Attackers love filling up disks to disable logging or cause chaos.

Knowing where your space went is the first step to fixing (and preventing) all of this.

How Do df and du Work?

How df Works: The Big Picture

• What: df (“disk free”) shows you the total and available space on each mounted filesystem (think: partitions, volumes, Docker overlay, etc).
• How: It asks the kernel for the stats — not your files! — so it’s super fast and gives a high-level summary.
• Bonus: Shows inodes (the “slots” for files, which can fill up even if you have bytes free).

How du Works: The Detective

• What: du (“disk usage”) shows you how much space is used by files and directories (not partitions), starting from a location you choose.
• How: It walks the actual directory tree, summing up the size of every file and subdirectory. This takes more time but tells you where the space is going.
• Bonus: Can be filtered, sorted, and customized to quickly find the biggest offenders.

How to Set Up (Fast & Easy)

• Good news: Both df and du are built into every Unix-like OS (Linux, BSD, macOS). No install needed. Just open your terminal and go!
• For Windows servers, use Sysinternals DU or the fsutil command for rough equivalents.

Use Cases: When to Use df vs du (Comic Table!)

Let’s imagine df and du as two quirky detectives:

TL;DR: df is your “how full is my disk?” tool. du is your “what’s filling it up?” tool.

Step-By-Step Guide: Checking Disk Space Like a Pro

Step 1: Check Overall Disk Usage

df -h

• -h = human-readable (GB, MB, etc.)
• Shows all mounted filesystems and their usage

Step 2: Check Inode Usage (for sneaky problems)

df -i

• Shows number of inodes (file “slots”) used/free
• Essential for servers with millions of tiny files (think: mail queues, logs)

Step 3: Find Space Hogs with du

du -h --max-depth=1 /var

• –max-depth=1 means just the top level of /var (or any dir)
• Sort to find the worst offenders:

du -h --max-depth=1 /var | sort -hr | head -n 10

Step 4: Drill Down Further

du -h --max-depth=1 /var/log | sort -hr

• Keep drilling until you find the monster files!

Step 5: Clean Up Safely

• Delete or rotate logs, clear caches, or move old backups off the server.
• Pro tip: After deleting big files, check if they’re still open with lsof | grep deleted

Step 6: (Optional) Automate It!

# Quick script to email you when disk is over 90%
df -h | awk '$5+0 > 90 {print $0}' | mail -s "Disk Space Warning" you@example.com

Mini Glossary (with Real-Talk Definitions)

• Filesystem: The way your OS organizes and stores files. Think: a bookshelf (not the books themselves).
• Partition: A chunk of your disk, like a shelf on that bookshelf.
• Inode: The “card” for each book (file): tracks its name, location, permissions, etc. Run out of inodes? Can’t make new files, even with bytes free!
• Mount Point: Where a filesystem “appears” in your directory tree (e.g., /home, /var).
• Block Size: The size of each chunk of storage on disk. Small files can waste space if block size is big.
• tmpfs: A filesystem in RAM. Fast, but data vanishes on reboot.

Examples & Stories: What to Do (and NOT to Do)

• Good: Use df -h before every deploy or update. Catch full disks before they bite.
• Bad: Only using du in / (root) — it can take ages and may time out on big servers.
• Don’t: Delete files you don’t understand. Some files (e.g., database sockets, active logs) are critical for apps.
• Do: Check for open-but-deleted files with lsof | grep deleted — they can eat up space until the process restarts.
• Advanced: Use ncdu (see below) for a fast, interactive disk usage browser.

Common Myths, Beginner Mistakes & Similar Tools

• Myth: “If df says I have space, I’m good.”
  Fact: You can run out of inodes or fill up a partition even if the disk as a whole has free space.
• Mistake: Trusting du and df to always match.
  Reality: They measure different things! df measures filesystem blocks; du measures file sizes. Sparse files, open-but-deleted files, and mount overlays can cause differences.
• Similar Tools:
  • ncdu: Interactive, ncurses-based disk usage analyzer (super fast, my personal favorite for “where did my space go?!” moments)
  • diskus: Blazing fast disk usage summary, written in Rust
  • diskonaut: Terminal disk space navigator with a cool UI

“Use This If…” Decision Flowchart

Let’s make this fun. Imagine your disk is filling up. What should you use?

Is my server running out of space? 
   |
   v
Run: df -h
   |
   |---> Disk full? (YES)
   |           |
   |           v
   |     Which partition or mount?
   |           |
   |           v
   |     Run: du -h --max-depth=1 
   |           |
   |           v
   |     Spot the biggest hogs and clean up!
   |
   |---> Disk not full? (NO)
   |           |
   |           v
   |     Relax, but maybe set up monitoring.

Bonus: If you want to automate all this, set up a cron job with df and du outputs piped to email or logs!

Automation, Scripting & Unusual Tricks

• Automated Monitoring: Use df in cron to alert when disk usage >80%:

0 * * * * df -h | awk '$5+0 > 80 {print $0}' | mail -s "Disk Space Alert" admin@yourdomain.com

• Cleanup Script: Find and delete log files older than 30 days:

find /var/log -type f -mtime +30 -print -delete

• Show Top 10 Space Hogs in /home:

du -h /home/* | sort -hr | head -n 10

• Find Open-but-Deleted Files (the “Zombie” Problem):

lsof | grep deleted

Unconventional Usage

• Check space used by Docker volumes: sudo du -sh /var/lib/docker/volumes/*
• Track growth over time by logging df and du output daily for audit/compliance.

Interesting Fact

The difference between du and df can be huge on filesystems with sparse files (like VM images). A 100GB sparse file might show 100GB in du, but only use 2GB on disk!

Tales from the Trenches: The Curious Case of the Phantom Log

Once, on a late-night shift, a server was “out of space” but df -h swore we had 15GB free. du found nothing big. Turns out, a huge log file was deleted (rm’d), but the process writing to it never closed it. The disk space was still “held” by the process, invisible to du! Only lsof | grep deleted revealed the culprit. A quick service restart was all it took to release the space. Moral: When in doubt, check for zombie files!

Conclusion & Recommendations

• Use df for a quick, high-level view. It’s your first responder, your “is the house on fire?” tool.
• Use du to dig deep and find out what’s hogging the space. It’s your surgical scalpel.
• Automate both for peace of mind. Don’t wait for 2AM errors — set up smart alerts and cleanup scripts.
• Want more control? Consider upgrading your infrastructure. For robust, reliable hosting, check out VPS or dedicated servers with plenty of disk space and monitoring built in.
• Bonus: Try tools like ncdu for interactive disk space browsing, or diskus for lightning-fast summaries.

Final Takeaway: Mastering df and du is the difference between calmly fixing a problem and scrambling through a disaster. Don’t be that admin — check your disk space regularly, automate alerts, and always have your favorite disk tools at your fingertips! 🚀