Disk Usage Monitoring

Disk Usage Monitoring

A full disk on Ubuntu does not gracefully degrade — it causes write failures, database corruption, log loss, and application crashes. Monitoring disk usage proactively and knowing how to quickly find what is consuming space are essential operational skills. The disk-full post-mortems almost always reveal the same causes: log files, old database dumps, or accumulated temporary files that nobody cleaned up.

Checking disk space with df

# Show disk usage for all mounted file systems (human-readable)
df -h

# Show file system type too
df -hT

# Show a specific mount point
df -h /var/log

# Show inode usage (separate from block usage)
df -i

df -hT output

Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sda1      ext4       50G   42G  5.2G  89% /
/dev/sda2      ext4      200G   80G  110G  43% /home
/dev/sdb1      xfs       500G  120G  380G  24% /data
tmpfs          tmpfs      16G     0   16G   0% /dev/shm

⚠️ WARNING: A disk at 89% use is already in the danger zone. Linux file systems can refuse writes before reaching 100% because space is reserved for root (default 5% on ext4). A system disk at 90% can crash applications even though df shows 10% free. Alert at 80%, act at 85%.

Finding directory sizes with du

# Show total size of a directory
du -sh /var/log
du -sh /home/*    # Size of each home directory

# Show top-level subdirectory sizes (one level deep)
du -h --max-depth=1 /var | sort -rh | head -20

# Show sizes recursively, sorted by size (most space first)
du -h /var | sort -rh | head -20

# Show only directories (skip files)
du -h --max-depth=2 / 2>/dev/null | sort -rh | head -20

# Exclude specific directories (e.g., skip mounted NFS)
du -h --exclude=/proc --exclude=/sys /

Finding the largest directories under /var

$ du -h --max-depth=1 /var | sort -rh | head -10
38G     /var
22G     /var/log
8.5G    /var/cache
4.2G    /var/lib
1.8G    /var/spool

Inode monitoring

# Check inode usage on all file systems
df -i

# Find which directory has the most files (inode hog)
find / -xdev -printf '%h
' 2>/dev/null | sort | uniq -c | sort -rn | head -10

# Count files in a specific directory
find /var/spool/mail -type f | wc -l

# Find directories with inode usage over a threshold
find / -xdev -type d -exec bash -c 'count=$(ls -1 "{}" | wc -l); [ $count -gt 10000 ] && echo "$count {}"' \; 2>/dev/null

Alerting on disk usage

# Simple disk alert script
sudo nano /usr/local/bin/disk-alert.sh

/usr/local/bin/disk-alert.sh

#!/bin/bash
THRESHOLD=80
ALERT_EMAIL="admin@company.com"

df -H | grep -vE '^Filesystem|tmpfs|cdrom' | awk '{print $5 " " $1 " " $6}' | while read output; do
    use=$(echo $output | awk '{print $1}' | sed 's/%//')
    partition=$(echo $output | awk '{print $2}')
    mountpoint=$(echo $output | awk '{print $3}')
    if [ $use -ge $THRESHOLD ]; then
        echo "ALERT: $mountpoint ($partition) is ${use}% full" |             mail -s "Disk Alert: $(hostname)" $ALERT_EMAIL
    fi
done

sudo chmod +x /usr/local/bin/disk-alert.sh

# Run every 30 minutes via cron
echo "*/30 * * * * root /usr/local/bin/disk-alert.sh" | sudo tee /etc/cron.d/disk-alert

ncdu: interactive disk analysis

ncdu (NCurses Disk Usage) provides an interactive, navigable view of disk usage — far more practical than running du repeatedly.

# Install ncdu
sudo apt install -y ncdu

# Scan the root file system (excluding other mount points)
sudo ncdu -x /

# Scan a specific directory
sudo ncdu /var

# Scan and save results (useful for analyzing a remote system locally)
sudo ncdu -1xo /tmp/diskusage.json /
# View later:
ncdu -f /tmp/diskusage.json

Inside ncdu: navigate with arrow keys, press d to delete a file/directory, ? for help, q to quit.

Conclusion

Monitor disk usage with df -hT for a quick overview and du -h --max-depth=1 /var | sort -rh to drill into which directories are consuming space. Install ncdu for interactive analysis — it is far faster than navigating with repeated du commands. Set up a cron job to alert at 80% usage. Remember to check inode usage (df -i) separately from block usage, especially on file systems that store millions of small files.