How to Use du Command in Linux: Find What’s Eating Your Disk Space

You check your server and see the dreaded “disk full” warning. Your application is throwing errors. Logs won’t write. Something is eating all your disk space, but what?

This is where the du command in Linux becomes your best friend. Unlike tools that show you the big picture, du digs into specific directories and shows you exactly what’s consuming your precious storage. For a broader overview of disk management, see our comprehensive disk usage guide.

Let me walk you through everything you need to know about du. From basic usage to advanced techniques I use daily.

What is the du Command in Linux?

The du command stands for “disk usage.” It estimates and reports how much space files and directories occupy on your system. Think of it as a detective tool for tracking down space hogs.

Understanding ‘Disk Usage’ vs ‘Disk Free’

Linux gives you two complementary tools. The df command shows filesystem-level capacity. It’s like a satellite view of your storage landscape. Du provides the ground-level investigation, drilling down into specific directories.

I remember the first time a production server filled up at 3 AM. Running df told me /var was at 100%. But which subdirectory? That’s when du saved the day.

How du Calculates Directory Sizes

Under the hood, du traverses directory trees using stat() system calls. It reads metadata about each file and adds up the disk blocks allocated to them. This means it can take time on massive directories with millions of files.

The key insight: du shows actual disk allocation, not file content size. A 1KB file might occupy a 4KB disk block. This distinction matters when hunting for storage waste.

When You Need du Instead of df

Use du when you need to:

• Pinpoint which directory is full: df says /home is at 90%, du tells you it’s /home/user/Downloads
• Find specific space hogs: That mystery folder eating 50GB
• Audit user directories: See who’s using the most space
• Clean up before backups: Identify what can be deleted or compressed

Basic du Command Syntax and Usage

The du command syntax follows the standard Linux pattern:

du [OPTIONS] [FILE/DIRECTORY]

The Standard Format

Running du without any options gives you the default behavior. It recursively scans the current directory and all subdirectories, printing sizes for each.

du /home/user

This command crawls through /home/user and every nested folder inside it.

Understanding the Default Output

Raw du output shows sizes in 512-byte blocks by default. Honestly, nobody wants to read that. The numbers look cryptic and require mental math.

4096    /home/user/documents
2048    /home/user/downloads

That’s why we almost always use the -h flag. But more on that in a moment.

Essential du Command Options for Daily Use

These are the flags I reach for constantly. Master these and you’ll handle 95% of disk space investigations. For a complete list of options, see the official du man page.

Human-Readable Output (-h)

The -h flag converts output to KB, MB, and GB. This is the option you’ll use most often.

du -h /var/log

Output becomes readable instantly:

1.2G    /var/log/journal
456M    /var/log/apache2
128K    /var/log/apt

Summary Mode (-s)

When you only want the total size of a directory, use -s (summary). It skips listing every subdirectory.

du -sh /var/log
2.1G    /var/log

I use du -sh dozens of times per day. It’s the quickest way to answer “how big is this folder?”

Include All Files (-a)

By default, du only reports directory sizes. The -a flag includes individual files in the output.

du -ah /home/user/project

This helps when you need to find that one massive log file hiding in a directory.

Grand Total (-c)

The -c flag adds a grand total at the bottom. Useful when checking multiple directories at once.

du -ch /var/log /tmp /home
1.2G    /var/log
500M    /tmp
45G     /home
46.7G   total

Control Depth (–max-depth)

Large directory trees produce overwhelming output. The –max-depth option limits how deep du scans.

du -h --max-depth=1 /var

This shows only the immediate subdirectories of /var. No deeper nesting. Clean, focused results.

Exclude Patterns (–exclude)

Skip certain files or directories with –exclude. This is a lifesaver for ignoring cache folders or temporary files.

du -h --exclude='*.log' /var

You can use multiple exclude patterns:

du -h --exclude='*.log' --exclude='*.tmp' /var

Practical du Examples Every Admin Should Know

Theory is fine, but let’s get practical. These are the commands I actually use when troubleshooting full disks.

Find the Largest Directories

This is the command I run first when disk space runs low:

du -h --max-depth=1 /var | sort -hr | head -10

It lists subdirectories of /var, pipes to the sort command for ranking by size (largest first), then shows only the top 10.

Check Specific Directory Size

Quick check on a single directory:

du -sh /var/log/apache2
1.8G    /var/log/apache2

Combine -s (summary) and -h (human-readable) for instant answers.

List All Files with Sizes

When you need file-level detail:

du -ah /home/user | sort -hr | head -20

This reveals the top 20 largest files and directories under /home/user.

Exclude Certain File Types

Calculating project size without counting video files:

du -sh --exclude='*.mp4' --exclude='*.mov' /media/projects

Handy when you want to know how much “real” content exists versus large media files.

Compare Multiple Directories

Check several directories at once:

du -sh /home/* | sort -hr

This shows each user’s home directory size, sorted largest first. Great for auditing shared systems.

du vs df: Understanding the Difference

These commands complement each other. Use both strategically. According to Red Hat’s comparison of du and df, the best practice is to use them together.

When to Use du

Du excels at investigation. Once you know a filesystem is filling up, du finds the culprit:

• Drilling into specific directories
• Finding large files
• Auditing user storage consumption
• Pre-cleanup analysis

When to Use df

The df command gives you the overview:

• Quick health checks on all filesystems
• Monitoring overall capacity trends
• Scripting alerts for low disk space
• Understanding partition layout

Why They Show Different Numbers

Sometimes du and df report different totals. This confuses people. The differences come from:

• Deleted but open files: Processes holding deleted files open still consume space (df sees it, du doesn’t)
• Filesystem metadata: Reserved blocks, journals, and inodes
• Mount points: Du stops at filesystem boundaries

Advanced du Techniques: Combining with Other Commands

The real power of du emerges when piping to other utilities. For technical details, consult the GNU Coreutils documentation.

Sort Output by Size

Ranking directories by space consumption:

du -h /var | sort -hr

The sort -hr flags mean human-readable sorting in reverse (largest first).

Find Top 10 Space Consumers

Limit output to the biggest offenders:

du -a /home | sort -n -r | head -n 10

This scans everything under /home and shows the top 10 largest items.

Use with find for Targeted Searches

Combine du with the find command for surgical precision:

find /home -type f -size +100M -exec du -h {} +

This finds all files larger than 100MB under /home and shows their sizes.

Monitor Disk Usage Over Time

Use the watch command to monitor directory growth:

watch -n 60 'du -sh /var/log'

This refreshes every 60 seconds. Perfect for watching a rapidly growing log directory.

Common du Command Issues and Solutions

Du isn’t without quirks. Here’s how to handle the common problems.

Permission Denied Errors

When checking system directories, you’ll often see permission errors:

du: cannot read directory '/root': Permission denied

The fix is simple. Use sudo:

sudo du -sh /root

For full system scans, always run with elevated privileges.

Slow Performance on Large Directories

Du can take minutes on directories with millions of files. Some strategies:

• Use –max-depth: Limit recursion depth
• Exclude large folders: Skip node_modules, .git, or cache directories
• Use ncdu: An interactive alternative (though du is better for scripting)

du -h --max-depth=1 --exclude='.git' --exclude='node_modules' /var/www

Apparent Size vs Actual Size

By default, du shows disk block allocation. For actual file content size, use –apparent-size:

du -h --apparent-size /home/user/file

This matters for sparse files. A sparse file might show as 1GB apparent size but only use 100MB of actual disk blocks.

Quick Reference: du Command Cheat Sheet

Here are the essential commands to keep handy:

The du command in Linux remains one of the most practical tools in any system administrator’s toolkit. Master these techniques and you’ll handle disk space issues with confidence.

Next time your server throws a disk full warning, you’ll know exactly where to look. Start with df to identify the full filesystem, then use du to hunt down the space hogs. It’s a workflow that’s saved me countless times.

For more disk management strategies, explore our guides on grep for filtering output and advanced file searching techniques.