Disk Usage and Cleanup: Essential Linux Tools (df, du, ncdu)

Avoid system crashes due to full disks with these powerful monitoring and cleanup tools

---

🚨 Why Disk Space Monitoring Matters

Running out of disk space is one of the most common causes of system crashes and application failures in Linux environments. When your disk reaches 100% capacity:

• Your system becomes unresponsive
• Databases can corrupt
• Critical services may fail
• Applications crash unexpectedly
• Log files stop writing, masking other issues

Understanding how to monitor, analyze, and manage disk usage is crucial for maintaining system stability.

---

📊 The df Command: Your First Line of Defense

The df (disk free) command provides a high-level view of disk usage across all mounted filesystems.

Basic Usage Examples

# Show disk usage for all mounted filesystems
df

# Display in human-readable format (KB, MB, GB)
df -h

# Show only specific filesystem type
df -t ext4

# Display inode usage instead of block usage
df -i

# Show filesystem type information
df -T

Understanding df Output

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G   15G  4.2G  79% /
/dev/sda2       100G   45G   50G  48% /home
tmpfs           2.0G     0  2.0G   0% /dev/shm

Key Columns Explained:

• Filesystem: Device or partition name
• Size: Total space available
• Used: Space currently occupied
• Avail: Space available for new files
• Use%: Percentage of space used ⚠️ Watch this closely!
• Mounted on: Where the filesystem is mounted

Critical Alert: Any filesystem showing 90%+ usage requires immediate attention!

---

🔍 The du Command: Deep Directory Analysis

While df shows overall filesystem usage, du (disk usage) helps identify which directories and files consume the most space.

Essential du Commands

# Show disk usage of current directory and subdirectories
du -h

# Show usage of current directory only (summary)
du -sh

# Show usage of specific directory
du -sh /var/log

# Sort directories by size (largest first)
du -sh /* | sort -hr

# Show only first level subdirectories with sizes
du -h --max-depth=1 | sort -hr

# Find directories larger than 1GB
du -h --threshold=1G

# Exclude certain file types from analysis
du -h --exclude="*.log" /var

# Include hidden files and directories
du -ah

Power User du Techniques

# Find the top 10 largest directories in /home
du -sh /home/* | sort -hr | head -10

# Analyze log file sizes
du -sh /var/log/* | sort -hr

# Find large files in current directory tree (files + dirs)
du -ah . | sort -hr | head -20

# Check specific user's home directory usage
du -sh /home/username

# Analyze system directories (excluding virtual filesystems)
du -sh /bin /usr /var /opt 2>/dev/null | sort -hr

Real-World du Examples

# Database directory analysis
du -sh /var/lib/mysql/*

# Web server content analysis
du -sh /var/www/* | sort -hr

# Find old backup files consuming space
find /backup -name "*.tar.gz" -exec du -sh {} \; | sort -hr

---

🎯 The ncdu Command: Interactive Disk Explorer

ncdu (NCurses Disk Usage) provides a powerful, interactive interface for exploring disk usage with visual navigation.

Installing ncdu (Not Available by Default)

# Ubuntu/Debian systems
sudo apt update && sudo apt install ncdu

# CentOS/RHEL systems
sudo yum install ncdu

# Fedora systems
sudo dnf install ncdu

# Arch Linux
sudo pacman -S ncdu

# macOS (if using Homebrew)
brew install ncdu

Using ncdu Effectively

# Analyze current directory interactively
ncdu

# Analyze specific directory
ncdu /var

# Exclude virtual filesystems and mount points
ncdu --exclude /proc --exclude /sys --exclude /dev /

# Export analysis to file for later review
ncdu -o diskusage.txt /home

# Import previously saved analysis
ncdu -f diskusage.txt

# Quick scan without interactive mode
ncdu -rr /path/to/analyze

ncdu Navigation Keys

Key	Action
↑↓	Navigate through directories
→ or Enter	Enter selected directory
← or Backspace	Return to parent directory
d	Delete selected file/directory ⚠️
g	Toggle percentage/graph display
s	Sort by size
n	Sort by name
c	Sort by items count
a	Toggle between apparent size and disk usage
i	Show file information
r	Recalculate current directory
q	Quit ncdu

---

🧹 Effective Cleanup Strategies

Common Space-Consuming Areas

1. Log Files Management

# Find large log files across the system
find /var/log -type f -size +100M -exec ls -lh {} \;

# Clean old log files (older than 30 days)
find /var/log -name "*.log" -type f -mtime +30 -delete

# Clean compressed old logs
find /var/log -name "*.gz" -type f -mtime +30 -delete

# Check systemd journal size
journalctl --disk-usage

# Clean old journal entries (keep last 2 weeks)
sudo journalctl --vacuum-time=2weeks

2. Package Cache Cleanup

# Ubuntu/Debian - Clean package cache
sudo apt autoremove
sudo apt autoclean
sudo apt clean

# Remove orphaned packages
sudo deborphan | xargs sudo apt-get -y remove --purge

# CentOS/RHEL - Clean yum cache
sudo yum clean all
sudo yum autoremove

# Fedora - Clean dnf cache
sudo dnf clean all
sudo dnf autoremove

3. Temporary Files Cleanup

# Clean /tmp directory (files older than 7 days)
sudo find /tmp -type f -atime +7 -delete

# Clean user cache directories
rm -rf ~/.cache/*
rm -rf ~/.thumbnails/*

# Clean browser caches
rm -rf ~/.mozilla/firefox/*/Cache/*
rm -rf ~/.config/google-chrome/Default/Cache/*

4. System Maintenance

# Ubuntu - Remove old kernel versions
sudo apt autoremove --purge

# Clean old crash reports
sudo rm -rf /var/crash/*

# Clean old snap versions (keep only 2 recent)
sudo snap set system refresh.retain=2

# Find and remove duplicate files
fdupes -r /home/username

---

💡 Real-Life Use Case: Email Alerts for Disk Usage Monitoring

Instead of complex scripts, let’s learn how to set up simple email alerts using the commands we’ve learned, perfect for beginners.

Step 1: Install Email Utilities

# Ubuntu/Debian
sudo apt update && sudo apt install mailutils

# CentOS/RHEL
sudo yum install mailx

# Test if email works
echo "Test message" | mail -s "Test Subject" your-email@company.com

Step 2: Create Simple Monitoring Commands

Here are beginner-friendly one-liners that you can use to monitor disk usage:

Check if Any Disk is Above 80% Full

df -h | awk 'NR>1 && $5+0 > 80 {print "WARNING: " $1 " is " $5 " full on " $6}'

Explanation: This command uses df -h to show disk usage, then awk filters lines where the 5th column (usage %) is greater than 80.

Send Email Alert When Disk is Full

# Check disk usage and send email if above 85%
df -h | awk 'NR>1 && $5+0 > 85 {
    system("echo \"WARNING: Disk " $1 " is " $5 " full on mount point " $6 "\" | mail -s \"Disk Alert - $(hostname)\" admin@company.com")
}'

Explanation: This extends the previous command to automatically send an email when usage exceeds 85%.

Get Top 5 Largest Directories and Email Report

# Generate a simple disk usage report
(
    echo "=== Disk Usage Report for $(hostname) ==="
    echo "Generated on: $(date)"
    echo ""
    echo "=== Current Disk Usage ==="
    df -h
    echo ""
    echo "=== Top 5 Largest Directories ==="
    du -sh /* 2>/dev/null | sort -hr | head -5
) | mail -s "Daily Disk Report - $(hostname)" admin@company.com

Explanation: This creates a simple report combining df -h (overall usage) and du -sh (directory sizes), then emails it.

Step 3: Set Up Automated Monitoring with Cron

Instead of complex scripts, use simple cron jobs:

# Edit your crontab
crontab -e

# Add these simple monitoring jobs:

# Check disk usage every 30 minutes and alert if >85%
*/30 * * * * df -h | awk 'NR>1 && $5+0 > 85 {system("echo \"Disk Alert: " $1 " is " $5 " full\" | mail -s \"Disk Warning\" admin@company.com")}'

# Send daily disk usage report at 9 AM
0 9 * * * (echo "Daily Disk Report:"; df -h; echo ""; echo "Largest directories:"; du -sh /var /home /usr 2>/dev/null) | mail -s "Daily Disk Report" admin@company.com

# Weekly detailed report using ncdu (if installed) every Sunday at 8 AM
0 8 * * 0 (echo "Weekly Disk Analysis:"; df -h; echo ""; if command -v ncdu >/dev/null; then echo "Run 'ncdu /' for detailed analysis"; else echo "Install ncdu for detailed analysis: sudo apt install ncdu"; fi) | mail -s "Weekly Disk Report" admin@company.com

Step 4: Simple Cleanup Commands for Alerts

When you receive a disk usage alert, here are simple commands to free up space:

Quick Cleanup Commands

# Clean package cache (Ubuntu/Debian)
sudo apt autoremove && sudo apt autoclean

# Clean old log files (older than 7 days)
sudo find /var/log -name "*.log" -mtime +7 -exec gzip {} \;

# Clean temporary files
sudo find /tmp -type f -mtime +3 -delete

# Find and remove large files (>100MB) - BE CAREFUL!
find /home -type f -size +100M -ls

Explanation: These commands clean common space-consuming areas safely. Always review what will be deleted before running cleanup commands.

Step 5: Interactive Monitoring with ncdu

Since ncdu provides the best visual analysis, here’s how to use it effectively:

# Install ncdu first
sudo apt install ncdu  # Ubuntu/Debian
sudo yum install ncdu  # CentOS/RHEL

# Analyze your system interactively
ncdu /

# Save analysis for later review
ncdu -o disk-analysis.txt /
# Later, view the saved analysis
ncdu -f disk-analysis.txt

# Quick analysis of specific directories
ncdu /var/log    # Check log files
ncdu /home       # Check user directories
ncdu /usr        # Check installed programs

Step 6: Creating Simple Monitoring Scripts

For beginners, here’s a simple 10-line monitoring script:

#!/bin/bash
# Simple disk monitor - save as monitor_disk.sh

# Get current disk usage percentage for root filesystem
USAGE=$(df -h / | awk 'NR==2 {print $5}' | sed 's/%//')

# Check if usage is above 80%
if [ "$USAGE" -gt 80 ]; then
    echo "WARNING: Disk usage is ${USAGE}%" | mail -s "Disk Alert" admin@company.com
    echo "$(date): Disk usage alert sent - ${USAGE}%" >> /var/log/disk-monitor.log
fi

Make it executable and add to cron:

chmod +x monitor_disk.sh
# Add to crontab to run every hour
0 * * * * /path/to/monitor_disk.sh

Step 7: Understanding the Email Reports

When you receive email alerts, here’s how to interpret them:

Sample Email Alert:

Subject: Disk Alert - myserver

WARNING: /dev/sda1 is 87% full on /

Current Status:
Filesystem     Size  Used Avail Use% Mounted on
/dev/sda1       20G   17G  1.8G  87% /

Action needed: Clean up files or add more storage.

What to do when you get this alert:

1. Login to your server
2. Use ncdu to find large directories: ncdu /
3. Check log files: du -sh /var/log/*
4. Clean up safely: Use the cleanup commands from Step 4
5. Verify improvement: Run df -h to check new usage

Step 8: Best Practices for Beginners

Set Up Multiple Alert Levels

# Warning at 80%
if [ "$USAGE" -gt 80 ]; then
    echo "WARNING: Disk ${USAGE}% full" | mail -s "Disk Warning" admin@company.com
fi

# Critical at 90%
if [ "$USAGE" -gt 90 ]; then
    echo "CRITICAL: Disk ${USAGE}% full - Immediate action needed!" | mail -s "CRITICAL Disk Alert" admin@company.com
fi

Regular Maintenance Commands

# Add these to your weekly routine:

# 1. Check overall disk usage
df -h

# 2. Find largest directories
du -sh /* | sort -hr | head -10

# 3. Clean up regularly
sudo apt autoremove  # Remove unused packages
sudo journalctl --vacuum-time=2weeks  # Clean old system logs

# 4. Use ncdu for detailed analysis
ncdu /var  # Analyze system files
ncdu /home # Analyze user files

---

🎯 Simple Monitoring Checklist for Beginners

✅ Install email utilities: sudo apt install mailutils
✅ Test email: echo "test" | mail -s "test" your-email@company.com
✅ Install ncdu: sudo apt install ncdu
✅ Set up basic cron job: Check disk usage every 30 minutes
✅ Create simple cleanup routine: Remove old logs and packages weekly
✅ Learn ncdu navigation: Practice with ncdu /home
✅ Set alert thresholds: 80% warning, 90% critical
✅ Test your setup: Verify you receive email alerts

This simple approach gives you effective disk monitoring without complex scripting, perfect for beginners learning system administration!