The df & du command in Linux
df (disk free) reports free and used space per filesystem; du (disk usage) measures how much space files and directories actually occupy. They answer the two halves of the same emergency: "the disk is full" (df tells you how bad) and "what is filling it?" (du tells you where). Both become readable with -h.
How df & du works
df and du measure different things, which is why they disagree. df asks each filesystem's superblock for its counters — total, used, free blocks — via one statvfs() call: instant, authoritative, and inclusive of everything on the volume. du walks the directory tree and sums the blocks of each file it can reach: slower, and blind to anything not reachable by a name.
The gap between them is informative. Deleted-but-open files (space held, no name) inflate df above du. ext4 reserves ~5% of blocks for root, which df counts as used-ish but no file owns. Files on other filesystems mounted inside the tree fool du unless -x confines it. And du reports allocated blocks, not logical size — a sparse 10 GB image may "weigh" 200 MB. Read df as "what the volume knows" and du as "what the tree contains", and every discrepancy becomes a clue instead of a mystery.
Syntax
df [-h] | du [-h] [-s] [PATH...]Common options
| Option | What it does |
|---|---|
df -h | All filesystems with sizes in K/M/G. |
df -h . | Just the filesystem containing the current directory. |
du -sh DIR | One total for a directory (-s summarize, -h human units). |
du -h --max-depth=1 | Size of each immediate subdirectory — the drill-down view. |
du -ah | Every file, not just directories. |
How to use df & du: examples
$ df -hThe overview: every mounted filesystem with size, used, available and mount point.
$ du -sh /var/logTotal size of a directory tree.
$ du -h --max-depth=1 /var | sort -hrThe classic disk hunt: subdirectory sizes, largest first. Repeat one level deeper each time.
$ du -ah . | sort -hr | head -n 20The twenty biggest files and folders under the current directory.
$ df -iInode usage — a filesystem can be "full" with free bytes if millions of tiny files exhaust inodes.
Real-world use cases for df & du
The 3am full-disk incident
Alerts fire: df -h confirms /var at 100%. Then the descent: du -h --max-depth=1 /var | sort -hr, enter the biggest directory, repeat — three iterations usually corner the offender (a log that never rotated, a forgotten dump). Total diagnosis time: two minutes.
Capacity checks before big operations
Before extracting a 20 GB archive or dumping a database: df -h /target/path shows available space on that specific filesystem — the check that prevents starting an operation that will die at 97%.
Pro tips and common mistakes
- Docker deserves first suspicion on dev machines: docker system df shows its usage, docker system prune reclaims it.
- du "sees" less than df when a deleted file is still held open: lsof +L1 lists such files; restarting the holder releases the space.
- ncdu (install it) is du with an interactive UI — arrow through directories sorted by size, delete on the spot.
- Exclude other filesystems from a scan with du -x — otherwise a scan of / wanders into every mounted volume.
Frequently asked questions about df & du
Why do df and du disagree about used space?
The classic cause is a deleted file still held open by a running process: du no longer sees it, but the space is not released until the process closes it (or is restarted), so df still counts it.
How do I find what is filling my disk?
Start at the top: du -h --max-depth=1 / 2>/dev/null | sort -hr, then descend into the biggest directory and repeat. Or install ncdu for an interactive version of exactly this.
What does "No space left on device" mean when df shows free space?
Check df -i: you may be out of inodes rather than bytes, typically caused by huge numbers of small files (mail queues, session files, node_modules).
Related commands
Delete files and directories — and understand -r, -f and why there is no trash bin.
findLocate files anywhere in a directory tree by name, type, size, date — and act on them.