Disk Usage

Filesystem capacity has at least two limits: data blocks and metadata objects such as inodes. df reports allocation from the filesystem's perspective, while du walks reachable pathnames and sums usage attributed to them. The values answer different questions and need not match.

Filesystem Capacity with df

Show mounted filesystem type and human-readable block figures with:

$ df -hT
Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/sda1      ext4  6.2G  2.3G  3.6G  40% /

Size, Used, and Avail come from filesystem accounting. Available space can be less than total minus used because of reserved blocks, metadata, allocation policy, quotas, or rounding. Run df on a path to report the filesystem containing that path:

$ df -hT /var/log

Inode Capacity

Filesystems that allocate inode-like objects can exhaust them even while blocks remain:

$ df -i /var

Large numbers of tiny files can consume available inodes. Deleting one large file frees many blocks but generally only one inode; deleting many unnecessary small files can relieve inode pressure. Some filesystems allocate metadata dynamically and report these concepts differently.

Path Usage with du

Summarize allocated space reachable below one directory:

$ du -sh /var/log

Compare immediate children while staying on one filesystem:

$ sudo du -xhd1 /var | sort -h

GNU options shown here mean human-readable output, maximum depth one, and one filesystem. Permissions can hide subtrees and produce an incomplete total. du can also count hard-linked files only once by default, distinguish apparent size from allocated blocks, and treat sparse files differently depending on options.

Why df and du Differ

Common causes include:

• a process keeps a deleted file open, so its blocks remain allocated but no pathname exists for du
• filesystem metadata, reserved space, journals, reflinks, snapshots, or compression affect accounting
• another filesystem is mounted within the walked tree
• permissions prevent du from reading some directories
• sparse files have different apparent and allocated sizes

For deleted-but-open files, inspect authorized processes with a tool such as lsof +L1; restart or signal the responsible service through its normal procedure rather than truncating unknown descriptors.

Investigating Without Making the Incident Worse

Start at the full filesystem reported by df, identify its mount target with findmnt, then narrow du searches on that same filesystem. Account for snapshots, container layers, logs, package caches, and application retention policy. Do not delete files solely because they are large; determine ownership, backup, compliance, and service behavior first.

Summary

You can now reconcile filesystem and pathname-based space reports.

1. Use df for mounted filesystem block capacity.
2. Use df -i for inode pressure where supported.
3. Use scoped du walks to attribute reachable path usage.
4. Investigate deleted-open files and filesystem-specific accounting differences.
5. Apply ownership and retention policy before deleting data.