Disk usage and open file tools: df (filesystem usage), du (directory sizes), lsof (open files, network connections, deleted-but-held files).
df — filesystem usage
df commands
| Command | Description |
|---|---|
| df -h | Human-readable sizes (GiB, MiB) |
| df -H | SI units (powers of 1000) |
| df -hT | Include filesystem type column |
| df -i | Inode usage instead of blocks |
| df /home | Usage for a specific mount point |
| df -x tmpfs -x devtmpfs | Exclude virtual filesystems |
| df -l | Local filesystems only (skip NFS) |
| df --output=source,fstype,size,used,avail,pcent,target | Custom columns |
A full disk (100% Use%) with many inodes but 0 inode usage left will also block writes. Check both: df -h and df -i.
du — directory sizes
du commands
| Command | Description |
|---|---|
| du -sh /var/log | Total size of a directory |
| du -sh * | Size of each item in current directory |
| du -h --max-depth=1 /var | One level deep, human-readable |
| du -sh * | sort -rh | head -20 | Top 20 largest items |
| du -sh /home/* | sort -rh | Home directories by size |
| du -ah / 2>/dev/null | sort -rh | head -30 | Top 30 largest files/dirs system-wide |
| du --exclude="*.mp4" -sh /home | Exclude a pattern from count |
| du -sh /proc /sys /dev | Virtual filesystem sizes (near 0) |
| du -sk * | sort -rn | head -10 | Top 10 by size in KB (numeric sort) |
-s = summary (one line per argument) · -h = human-readable · -a = all files, not just directories · --max-depth=N limits recursion.
lsof — open files
Files & processes
| Command | Description |
|---|---|
| lsof /var/log/syslog | Which processes have this file open |
| lsof -u alice | All files opened by user alice |
| lsof -p 1234 | All files opened by PID 1234 |
| lsof -c nginx | Files opened by processes named nginx |
| lsof +D /var/www | All files open under a directory (recursive) |
| lsof -d 4 | Files with file descriptor 4 |
| lsof -t /var/log/auth.log | PIDs only — useful in kill scripts |
| lsof -u alice -c vim | AND — alice AND vim |
| lsof -u alice -c vim -a | AND explicit — alice AND vim (with -a) |
Network connections
| Command | Description |
|---|---|
| lsof -i | All network connections |
| lsof -i :80 | Processes using port 80 |
| lsof -i TCP:22 | TCP connections on port 22 |
| lsof -i @10.0.0.1 | Connections to a specific host |
| lsof -i TCP -s TCP:LISTEN | Listening TCP ports only |
| lsof -i UDP | UDP sockets |
| lsof -i 4 | IPv4 only |
| lsof -i 6 | IPv6 only |
Deleted files (disk not freed)
| Command | Description |
|---|---|
| lsof | grep deleted | Files deleted but still held open — disk space not freed until process closes them |
| lsof -p 1234 | grep REG | Regular files open by a process |
| ls -la /proc/1234/fd/ | All file descriptors of a process |
| cp /proc/1234/fd/3 /tmp/recovered | Recover a deleted file via /proc fd link |
| kill -HUP $(lsof -t /var/log/app.log) | Signal process to reopen log file |
Common use case: df -h shows 100% full but du -sh /* doesn’t add up → a deleted file is still held open. Find it with lsof | grep deleted, then restart or HUP the process.