Monitoring Linux Disk Usage: Essential Tools and Techniques

Table of Contents

1. Basic CLI Tools for Disk Monitoring
   • df: Check Filesystem Usage
   • du: Analyze Directory/File Sizes
   • ls: Inspect Individual File Sizes
2. Advanced CLI Tools for Deep Dives
   • ncdu: Interactive Disk Usage Analyzer
   • find: Locate Large or Recent Files
   • lsof: Identify Open/Deleted Files
3. Graphical Tools for Visualization
   • GNOME Disks (Disk Utility)
   • Baobab (Disk Usage Analyzer)
   • Filelight (KDE)
4. Automation and Alerting
   • Cron Jobs for Scheduled Checks
   • Scripting Disk Usage Alerts
   • Enterprise-Grade Monitoring Tools (Nagios, Prometheus)
5. Best Practices for Disk Monitoring
6. Conclusion
7. References

Basic CLI Tools for Disk Monitoring

Command-line tools are the backbone of Linux disk monitoring, offering speed, flexibility, and scriptability. Let’s start with the fundamentals.

1. df: Check Filesystem Usage

The df (disk free) command provides an overview of mounted filesystem usage, including total space, used space, free space, and mount points. It’s ideal for quickly assessing overall disk health.

Key Options:

• -h: Human-readable format (e.g., KB, MB, GB).
• -T: Show filesystem type (e.g., ext4, xfs, tmpfs).
• -i: Check inode usage (critical for systems with many small files).
• -P: POSIX-compliant output (useful for scripting).

Examples:

# Check all mounted filesystems in human-readable format  
df -h  

# Check usage for the root filesystem (/), with type  
df -hT /  

# Check inode usage (avoid "no space left on device" errors due to inode exhaustion)  
df -i /  

Output Explanation:

Filesystem      Size  Used Avail Use% Mounted on  
/dev/sda1       20G   12G  7.2G  62% /  
tmpfs           3.9G     0  3.9G   0% /dev/shm  
/dev/sdb1       100G   45G   55G  45% /data  

• Filesystem: The device or partition (e.g., /dev/sda1).
• Size: Total capacity of the filesystem.
• Used/Avail: Space consumed and remaining (in human-readable units with -h).
• Use%: Percentage of space used (critical for alerts).

2. du: Analyze Directory/File Sizes

While df shows filesystem-level usage, du (disk usage) drills down into directory and file sizes, helping you identify what’s consuming space.

Key Options:

• -s: Summary of total size for a directory (exclude subdirectories).
  • -sh: Combine with -h for a human-readable summary (e.g., du -sh /home).
• -a: Include all files (not just directories).
• --max-depth=N: Limit recursion to N levels (e.g., --max-depth=1 for top-level subdirectories).
• -c: Show a grand total at the end.

Examples:

# Get total size of /var/log (summary, human-readable)  
du -sh /var/log  

# List sizes of all subdirectories in /home (1 level deep)  
du -h --max-depth=1 /home  

# Find largest files in /tmp (including hidden files)  
du -ah /tmp | sort -rh | head -5  

Pro Tip:

Combine du with sort to quickly identify space hogs:

# List top 10 largest directories in / (sorted by size, descending)  
du -h --max-depth=1 / | sort -rh | head -10  

3. ls: Inspect Individual File Sizes

The ls command, while primarily for listing files, can also reveal individual file sizes with the right flags.

Key Options:

• -l: Long format (includes size, permissions, owner).
• -h: Human-readable size (e.g., 1K, 234M, 2G).
• -S: Sort files by size (descending order).

Example:

# List largest files in the current directory (sorted by size)  
ls -lhS | head -10  

Advanced CLI Tools for Deep Dives

For more granular analysis—such as tracking down hidden large files, identifying deleted files still consuming space, or interactive exploration—these advanced tools are indispensable.

1. ncdu: Interactive Disk Usage Analyzer

ncdu (NCurses Disk Usage) is a terminal-based, interactive tool that lets you navigate directories and visualize space usage in real time. It’s faster than du for large filesystems and perfect for exploratory analysis.

Installation:

# Debian/Ubuntu  
sudo apt install ncdu  

# RHEL/CentOS  
sudo yum install ncdu  

# Fedora  
sudo dnf install ncdu  

Usage:

Run ncdu followed by a directory path (omit the path to scan the current directory):

ncdu /home  # Analyze /home  

Features:

• Navigate with arrow keys, Enter (drill into directory), and Backspace (go up).
• Delete files/directories directly (press d, then confirm).
• Sort by size (s), name (n), or items (i).
• See percentage of total space used for each entry.

2. find: Locate Large or Recent Files

The find command is a powerful utility for searching files based on criteria like size, age, or name. It’s ideal for tracking down large, forgotten files or recently modified space hogs.

Examples:

# Find all files >1GB in / (excluding /proc to avoid noise)  
find / -type f -size +1G -not -path "/proc/*"  

# Find files >500MB modified in the last 7 days (in /home)  
find /home -type f -mtime -7 -size +500M  

# Get sizes of found files (combine with du)  
find /var -type f -size +100M -print0 | xargs -0 du -h  

Pro Tip:

Use -exec to take action on found files (e.g., delete old logs):

# Delete .log files >30 days old and >100MB in /var/log  
find /var/log -name "*.log" -mtime +30 -size +100M -exec rm -f {} \;  

3. lsof: Identify Open/Deleted Files

A common gotcha: A file deleted with rm may still consume space if it’s open by a process (e.g., a log file being written to by a service). lsof (list open files) reveals these “zombie” files.

Examples:

# Find all deleted files still in use (and their processes)  
lsof | grep deleted  

# Free space by killing the process holding the deleted file  
# (Replace PID with the process ID from lsof output)  
kill -9 PID  

Output Explanation:

nginx   1234   root   12w   REG    8,1  536870912  /var/log/nginx/access.log (deleted)  

Here, nginx (PID 1234) is still writing to access.log, even though it was deleted. Killing the process frees the space.

Graphical Tools for Visualization

For users who prefer visual feedback, Linux offers GUI tools that transform raw disk data into charts, treemaps, and interactive maps.

1. GNOME Disks (Disk Utility)

GNOME Disks (formerly palimpsest) is a user-friendly GUI tool preinstalled on most GNOME-based systems (e.g., Ubuntu, Fedora). It provides an overview of disks, partitions, and usage.

Features:

• View all connected drives (HDDs, SSDs, USBs) and their partitions.
• Check usage percentage, free space, and filesystem type for each partition.
• Mount/unmount partitions, format drives, or create disk images.

How to Launch:

• Search for “Disks” in the application menu, or run gnome-disks in the terminal.

2. Baobab (Disk Usage Analyzer)

Baobab (also called “Disk Usage Analyzer”) is a treemap-based tool that visualizes disk usage with colorful blocks, making it easy to spot large directories. It’s preinstalled on GNOME and works on other desktops too.

Features:

• Scan specific directories or entire filesystems.
• Switch between treemap (visual) and list (detailed) views.
• Filter results by file type (e.g., images, documents).

How to Launch:

• Search for “Disk Usage Analyzer” in the menu, or run baobab in the terminal.

3. Filelight (KDE)

Filelight is KDE’s disk usage visualization tool, known for its intuitive pie-chart and sunburst diagrams. It’s lightweight and works on non-KDE desktops (e.g., GNOME, Xfce).

Features:

• Interactive, zoomable pie charts for directory hierarchies.
• Scan local or remote filesystems (e.g., NFS, Samba).
• Directly delete files/directories from the interface.

Installation:

# Debian/Ubuntu  
sudo apt install filelight  

# Fedora  
sudo dnf install filelight  

Automation and Alerting

For sysadmins, manual monitoring is unsustainable. Automating checks and setting up alerts ensures you’re notified of issues before they cause downtime.

1. Cron Jobs for Scheduled Checks

Use cron to run disk usage checks at regular intervals (e.g., daily) and log results or trigger alerts.

Example Cron Job:

Add this to crontab -e to run a disk check every day at 2 AM and save results to a log:

0 2 * * * df -h > /var/log/disk_usage_$(date +\%Y\%m\%d).log  

2. Scripting Disk Usage Alerts

Write a bash script to check disk usage and send an email/SMS alert if space exceeds a threshold (e.g., 90%).

Sample Script:

#!/bin/bash  
THRESHOLD=90  
EMAIL="[email protected]"  

# Check all mounted filesystems (excluding tmpfs)  
df -P | grep -vE '^Filesystem|tmpfs|cdrom' | awk '{ print $5 " " $6 }' | while read -r output; do  
  PERCENTAGE=$(echo "$output" | awk '{ print $1}' | sed 's/%//g')  
  MOUNT=$(echo "$output" | awk '{ print $2 }')  

  if [ "$PERCENTAGE" -ge "$THRESHOLD" ]; then  
    echo "Warning: Disk usage on $MOUNT is at $PERCENTAGE%" | mail -s "Disk Space Alert: $MOUNT" "$EMAIL"  
  fi  
done  

Make It Executable and Schedule with Cron:

chmod +x /usr/local/bin/disk_alert.sh  
# Add to crontab to run hourly  
0 * * * * /usr/local/bin/disk_alert.sh  

3. Enterprise-Grade Monitoring Tools

For large environments, use tools like Nagios, Zabbix, or Prometheus to centralize monitoring and set up sophisticated alerts.

• Nagios/Zabbix: Monitor disk usage across hundreds of servers, with dashboards and alerts via email/Slack.
• Prometheus + Node Exporter: Collect metrics (including disk usage) from Linux nodes, and visualize with Grafana. Set up alerts in Prometheus for thresholds.

Best Practices for Disk Monitoring

To maintain healthy disk usage, follow these guidelines:

1. Monitor Inodes, Not Just Space: Use df -i to check inode usage—running out of inodes (even with free space) causes “no space left” errors.
2. Clean Up Logs and Temp Files: Use logrotate to manage log files, and定期清理 /tmp (e.g., with tmpreaper).
3. Audit Large Files Regularly: Use ncdu or find monthly to identify forgotten backups, old logs, or large user files.
4. Avoid Over-Mounting: Too many mounted filesystems (e.g., USB drives, NFS shares) can complicate monitoring—track them explicitly.
5. Document Storage Policies: Define retention periods for logs, backups, and user data to prevent unplanned growth.

Conclusion

Monitoring Linux disk usage is a foundational skill for system administrators and power users. From basic df checks to advanced tools like ncdu and enterprise monitoring with Prometheus, the Linux ecosystem offers solutions for every use case. By combining proactive monitoring, automation, and best practices, you can ensure your systems stay resilient and avoid costly downtime.

References

• df Man Page: linux.die.net/man/1/df
• du Man Page: linux.die.net/man/1/du
• ncdu Documentation: dev.yorhel.nl/ncdu
• Prometheus Node Exporter: prometheus.io/docs/guides/node-exporter
• GNOME Disks: gnome.org/apps/disks
• lsof Man Page: linux.die.net/man/8/lsof