This is one of the most useful things you have to do on servers that have been running a while and have filled up the mountpoint. So, one of the first things I do is run df -h command.
This command will give you the mount points and the percent of used space. This way you can tell where you need to start your actual investigation. See, unix/linux is a layered mounting system. At least, that is how I look at it. This layered approach allows you to overlay mount points as a directory. Well, this is like a link dir command I am not going to get into this to deep. Suffice it to say, it allows a path to point to other locations and not just one disk system. This is also possible in windows; however, that is again out of scope. Understanding this layering allows you to focus on the disk and mountpoint that is the fullest. Ok so, it may not just be the root file system on disk 1. It may be a mountpoint like /opt that is actually full. See, df -h helps you focus in on the key disk that is full.
So, running df -h like below:
This will output something like this below
root@word-02:~# df -h Filesystem Size Used Avail Use% Mounted on udev 3.9G 0 3.9G 0% /dev tmpfs 795M 548K 794M 1% /run /dev/sda1 32G 3.4G 27G 12% / tmpfs 3.9G 136K 3.9G 1% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock /dev/sda15 124M 12M 113M 10% /boot/efi tmpfs 795M 0 795M 0% /run/user/1000
Now du Command
So, once you have identified the location you want to focus on you can go to the dir with cd command and run du command like this one below:
du -ah | sort -hr | head -5
This will produce an output like below:
root@word-02:~# cd /
root@word-02:/# du -ah | sort -hr | head -5
du: cannot access ‘./proc/46911/task/46911/fd/4’: No such file or directory
du: cannot access ‘./proc/46911/task/46911/fdinfo/4’: No such file or directory
du: cannot access ‘./proc/46911/fd/3’: No such file or directory
du: cannot access ‘./proc/46911/fdinfo/3’: No such file or directory
See, from this command now you know you can focus on /usr dir. Which makes sense in this above example because that is the location where the web for this site is running. So see, this gives you a quick way to find where space is used!