This is one of the most useful things you have to do on servers that have been running a while and have filled up the mountpoint. So, one of the first things I do is run df -h command.

df -h

This command will give you the mount points and the percent of used space. This way you can tell where you need to start your actual investigation. See, unix/linux is a layered mounting system. At least, that is how I look at it. This layered approach allows you to overlay mount points as a directory. Well, this is like a link dir command I am not going to get into this to deep. Suffice it to say, it allows a path to point to other locations and not just one disk system. This is also possible in windows; however, that is again out of scope. Understanding this layering allows you to focus on the disk and mountpoint that is the fullest. Ok so, it may not just be the root file system on disk 1. It may be a mountpoint like /opt that is actually full. See, df -h helps you focus in on the key disk that is full.

So, running df -h like below:

df -h

This will output something like this below

root@word-02:~# df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            3.9G     0  3.9G   0% /dev
tmpfs           795M  548K  794M   1% /run
/dev/sda1        32G  3.4G   27G  12% /
tmpfs           3.9G  136K  3.9G   1% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
/dev/sda15      124M   12M  113M  10% /boot/efi
tmpfs           795M     0  795M   0% /run/user/1000

Now du Command

So, once you have identified the location you want to focus on you can go to the dir with cd command and run du command like this one below:

du -ah | sort -hr | head -5

This will produce an output like below:

root@word-02:~# cd /
root@word-02:/# du -ah | sort -hr | head -5
du: cannot access './proc/46911/task/46911/fd/4': No such file or directory
du: cannot access './proc/46911/task/46911/fdinfo/4': No such file or directory
du: cannot access './proc/46911/fd/3': No such file or directory
du: cannot access './proc/46911/fdinfo/3': No such file or directory
3.4G .
2.8G ./usr
1.2G ./usr/local/lsws
1.2G ./usr/local
961M ./usr/lib

See, from this command now you know you can focus on /usr dir. Which makes sense in this above example because that is the location where the web for this site is running. So see, this gives you a quick way to find where space is used!