Disk Usage & Filesystems

When a Linux system feels “broken,” a very common cause is not software—it is storage. If a disk (or partition) fills up, programs cannot save data. This leads to real problems:

• Applications fail to start or crash
• Logs stop recording (so you cannot diagnose issues)
• System updates fail
• Web servers and databases stop working

In other words, a “full disk” can make a healthy system look completely broken.

This lesson teaches you how to answer one key question:

“Where did all my disk space go?”

Try it with provided snapshot files (diff + sed)

Before using real system commands, we practice on saved outputs in ~/playground/chapter9. This helps you focus on reading and understanding output instead of being overwhelmed by a live system.

Real troubleshooting usually works like this:

• Compare “before vs after” → What changed?
• Filter the output → Show only what matters

We can use the diff and sed commands we learned in the previous lesson to practice on saved outputs.

diff -u compares two files and shows changes in a readable format.

sed -n '/pattern/p' means:

• -n → do not print everything
• /pattern/ → look for matching lines
• p → print those matches

Example: '/\/var\/log/' matches the text /var/log. The slashes are escaped because / is used as a delimiter.

# Go to the practice folder
cd ~/playground/chapter9

# Compare “before vs after” disk usage (what changed?)
diff -u df_before.txt df_after.txt

# Compare “before vs after” directory breakdown for /var
diff -u du_var_before.txt du_var_after.txt

# Extract just the /var/log line from the "after" breakdown
sed -n '/\/var\/log/p' du_var_after.txt

Goal: Notice that /var/log grew. This is a very common real-world issue.

Disk Usage Commands

In this lesson, we will be using the following commands to find out where the disk space is going:

Quick Reference

Important idea: These tools answer different parts of the same problem.

Find the filesystem that is full (df)

The df command shows disk usage by filesystem (not individual folders).

Think of a filesystem like a “container” that holds directories such as / or /home.

Run:

df -h

Focus on this column:

• Use% → how full the filesystem is

If you see something like 98% or 100%, that is your problem.

Key idea: df tells you which filesystem is full, not what inside it is causing the problem.

df [options] [mountpoint_or_path]

Common Options

# Human-readable disk usage by mount point
df -h

# Sometimes helpful: include filesystem type
df -hT

Understand disk/partition layout (lsblk)

lsblk shows how storage is physically organized.

Key terms:

• Disk → the physical device (SSD/HDD)
• Partition → a slice of that disk
• Filesystem → how data is organized on that partition

Analogy:

• Disk = hard drive
• Partition = sections of the drive
• Filesystem = filing system inside each section

lsblk [options]

Use -f to connect partitions to filesystems and mount points.

# View disks/partitions + filesystem info
lsblk -f

When you run lsblk -f, the output shows a “tree” of storage devices:

This is an example of the output:

• NAME: the device/partition name (for example, sda is a whole disk, and sda1 is a partition on that disk).
• FSTYPE: the filesystem type that partition uses (for example, xfs, ext4, or vfat). If you see LVM2_member, that part is part of an LVM setup rather than a normal filesystem.
• LABEL: a human-friendly name given to the filesystem (sometimes empty).
• UUID: a unique identifier for the filesystem (useful for reliably finding a filesystem even if it is renamed).
• MOUNTPOINT: the directory where that filesystem is currently mounted (this is the key connection to df).

In the screenshot, you can use MOUNTPOINT to spot which devices are actually visible in the directory tree (for example, items mounted at /boot, /boot/efi, or /home/students). Once you know the mount point, you can interpret disk-full symptoms with df and find large folders with du.

Why this matters: It helps you connect what df shows (mount points) to actual devices.

Map a path to its mount point (findmnt)

A mount point is where a filesystem appears in the directory tree.

Example:

• / → root filesystem
• /home → may be a separate filesystem

findmnt answers:

“What filesystem is this directory on?”

findmnt [path]

# See mount information for a path
findmnt /

# See mount information for /home
findmnt /home

Why this matters: You must stay inside the correct filesystem when troubleshooting disk usage.

Find what directories are taking space (du)

du shows how much space directories and files are using.

This is where you actually find the problem.

Strategy:

• Start at a high level
• Find the biggest directory
• Go one level deeper
• Repeat

du [options] path

Key Concepts

• --max-depth=1 → only show top-level folders (keeps output readable)
• 2>/dev/null → hide permission errors
• | sort -h → sort from smallest to largest

Think of this pipeline:

du → clean output → sort → find biggest

# Show top-level directories under /home (skip unreadable parts)
du -h --max-depth=1 /home 2>/dev/null | sort -h

# Show top-level under /var (often contains logs/cache)
du -h --max-depth=1 /var 2>/dev/null | sort -h

# If you find a big folder, go one level deeper
du -h --max-depth=1 /var/log 2>/dev/null | sort -h

Real-world tip: /var/log is one of the most common causes of disk filling up.

Disk Full Workflow (Putting It All Together)

When troubleshooting disk space, always follow this order:

• 1. Run df -h → find the full filesystem
• 2. Run du → find the largest directories
• 3. Drill down → find the exact cause

Simple mental model:

• df = “Where is the problem?”
• du = “What is causing the problem?”

If you remember nothing else from this lesson, remember that workflow.