Disk Usage: Mapping Your Storage

Disk space is like a closet—no matter how much you have, you eventually fill it up. In Linux, running out of disk space is a "System-Killing" event. If a server reaches 100% usage, it can't write log files, databases crash, and you might not even be able to log in.

As an administrator, you need to know:

1. Which Partition is full? (df)
2. Which Directory is eating the space? (du)
3. Which Physical Drive is it on? (lsblk)

In this lesson, we will learn to navigate the storage landscape.

---

1. lsblk: The Physical View

Before we talk about folders, we must look at the "Blocks." lsblk (List Block Devices) shows you the physical hard drives and how they are split into partitions.

lsblk

Decoding the names:

• sda: The first physical disk (SCSI/SATA).
• sdb: The second physical disk.
• sda1: The first partition on the first disk.
• nvme0n1: A fast NVMe SSD.

---

2. df: The File System View

df (Disk Free) tells you how much space is left on your mounted filesystems.

df -h # -h for Human-readable (G, M, K)

What to Look For:

• Used%: If this is over 90%, you are in the "Danger Zone."
• Mounted on: This tells you where in the Linux tree that disk lives.
  • / is your primary storage.
  • /boot is where the kernel lives.
  • /mnt/external might be a USB drive.

---

3. du: The Folder Detective

df tells you the disk is full, but it doesn't tell you which file is to blame. For that, we use du (Disk Usage).

# See how much space each folder in the current directory takes
du -sh *

# Find the 10 largest folders in the whole system (Requires sudo)
sudo du -ah / | sort -rh | head -n 10

The Flags:

• -s: Summary (don't show every subfolder).
• -h: Human-readable.
• -a: All (show files, not just folders).

---

4. The "Ghost File" Mystery

Sometimes df says the disk is 100% full, but du says you have 50GB of free space. How is this possible?

The Deleted-but-Open File: In Linux, if you delete a file (like a massive log) while a program is still writing to it, the file name disappears, but the disk space isn't reclaimed until the program is closed.

How to find these "Ghost" files:

sudo lsof / | grep deleted

---

5. Practical: Identifying the Biggest Culprits

Run this command when you need to clean up a server quickly:

# List all files over 100MB in size
sudo find / -type f -size +100M -exec ls -lh {} \;

---

6. Example: A Disk Space Watchdog (Python)

If you are running a server, you want an automated tool that checks for space. Here is a Python script that reports on disk health and returns a non-zero exit code if any partition is critically full.

import shutil
import sys

def check_disk_health(path="/", threshold_percent=90):
    """
    Checks the storage health of a specific path.
    """
    # Get usage stats
    total, used, free = shutil.disk_usage(path)
    
    percent_used = (used / total) * 100
    
    print(f"Directory: {path}")
    print(f"  Total: {total / (2**30):.2f} GB")
    print(f"  Used:  {used / (2**30):.2f} GB ({percent_used:.1f}%)")
    print(f"  Free:  {free / (2**30):.2f} GB")
    
    if percent_used > threshold_percent:
        print(f"\n[ALERT] Disk usage on {path} is CRITICAL (> {threshold_percent}%)!")
        return False
    
    return True

if __name__ == "__main__":
    # Check the Root (/) and the Data (/data if it exists)
    paths_to_check = ["/"]
    
    all_healthy = True
    for p in paths_to_check:
        if not check_disk_health(p):
            all_healthy = False
            
    if not all_healthy:
        sys.exit(1) # Signal failure to calling systems (e.g., CI/CD)

---

7. Professional Tip: Use 'ncdu'

Standard du text output is hard to read. If you can, install ncdu (NCurses Disk Usage). It's an interactive tool that lets you navigate through your folders and see exactly where the space is going with a visual bar.

---

8. Summary

Storage management is about monitoring the physical, the logical, and the granular.

• lsblk shows the hardware layout.
• df shows the filesystem health.
• du identifies the space-hogging directories.
• Always check for Deleted-but-open files if the numbers don't add up.

In the next lesson, we will learn how to deal with the apps that use these resources: Process Management with ps, kill, and nice.

Quiz Questions

1. What is the difference between df and du?
2. Why would a 100% full /boot partition prevent a system from updating?
3. Which disk name is standard for a modern NVMe SSD drive?

---

Continue to Lesson 4: Process Management—ps, kill, and nice.