df vs du: Linux Disk Usage Commands Explained

The df and du commands are the two standard command-line tools for checking disk usage on Linux and Unix-like systems: df reports free and used space on entire mounted filesystems, while du estimates the space consumed by individual files and directories. You run df -h to see how full each disk is, and du -sh /path to see how much a specific folder occupies. Both are preinstalled on virtually every distribution, and understanding their differences prevents the classic confusion of “why does df show 100% but du doesn’t add up?”

What df Actually Does

The df command (short for “disk free”) queries the operating system for each mounted filesystem’s total blocks, used blocks, and available blocks. It does not scan individual files; it reads the filesystem’s metadata directly, which is why it is extremely fast even on huge disks. The output shows one line per mounted filesystem, including the device name (e.g., /dev/sda1), the mount point (e.g., /), and the size, used, available, use%, and mount location.

Key options:

• -h – human-readable sizes (KB, MB, GB).
• -T – show the filesystem type (ext4, xfs, etc.).
• -i – show inode usage instead of block usage (useful when you run out of inodes but have free space).
• df /home – show only the filesystem that contains the given path.

A common gotcha: df shows the space on the filesystem, not the partition. If you have a partition mounted at /var, then df /var shows that partition’s usage, not the root partition’s. Also, df reports “available” space, which for most filesystems is slightly less than “free” because a percentage of blocks is reserved for the root user (typically 5% on ext4). That reserved space is not counted as available, which is why df may show 95% used even when you have files you can delete.

What du Actually Does

The du command (short for “disk usage”) walks through the directory tree, stat-ing every file and summing the number of disk blocks each file occupies. Unlike df, it does not read the filesystem superblock; it counts actual file sizes. This makes it slower on large trees, but it gives you a per-directory breakdown that df cannot provide.

Key options:

• -s – summary only (just the total for the given path).
• -h – human-readable sizes.
• -a – show all files, not just directories.
• -x – stay on the same filesystem (do not cross mount points).
• --max-depth=N – show subdirectories up to N levels deep.

For example, du -sh /var/log gives a single line with the total size of the log directory. du -h --max-depth=1 /home shows the size of each user’s home folder plus the total. This is the go-to command when you need to find what is filling up a disk.

Why df and du Disagree

It is very common to see df report 100% usage while du on the same mount point shows far less total. This happens for several real reasons:

• Deleted but open files: A process may have deleted a file, but if the process still has the file open, the space is not released. du cannot see the deleted file, but df still counts the blocks as used. Restarting the process (or the system) frees the space.
• Reserved blocks: As mentioned, ext4 reserves ~5% of the filesystem for root. du does not account for this reserved space, so the sum of all files will always be less than what df shows as used.
• Metadata and journal: The filesystem itself uses blocks for inodes, directory entries, and the journal. du only counts file data, not this overhead.
• Hidden files and permissions: If you run du as a non-root user, you may not have permission to read certain directories, so du silently skips them. Running sudo du gives a more complete picture.
• Mount points inside the tree: If you run du on a directory that contains a mounted filesystem, du will by default descend into that mount and count its files, which can double-count space. Use -x to avoid crossing filesystems.

The practical takeaway: when a disk appears full, use df -h to confirm which filesystem is full, then use du -x -h --max-depth=1 /mountpoint to find the largest directories. If du totals are much smaller than df used, check for deleted open files with lsof | grep deleted (requires root).

Choosing Between df and du

Use df when you need a quick overview of all mounted filesystems, or when you want to know if a specific mount point is running out of space. Use du when you need to locate large files or directories, or when you want to see how much space a particular project or user consumes.

For everyday tasks:

• Check overall disk health: df -h.
• Find the biggest directories under /home: sudo du -x -h --max-depth=1 /home | sort -h -r.
• Check if a specific folder fits on a USB drive: du -sh /path/to/folder.
• Monitor inode exhaustion: df -i.

Remember that du counts logical file sizes, but on most filesystems files are stored in fixed-size blocks (typically 4 KB). A 1-byte file still occupies 4 KB of disk space, so du will show 4.0K for it. This is why du totals are often slightly larger than the sum of file sizes reported by ls -l.

Common Mistakes and Misconceptions

• Mixing up base-10 and base-2 units: df -h and du -h use powers of 1024 (KiB, MiB, GiB) by default on GNU systems. If you see a disk advertised as 1 TB, df will show it as ~931 GiB because the manufacturer uses decimal (1,000,000,000,000 bytes) while the OS uses binary (1,099,511,627,776 bytes). This is normal, not an error.
• Assuming du shows the same as df: As detailed above, they measure different things. Never be alarmed if they differ by a few percent.
• Forgetting the -x flag: Running du on / without -x will include all mounted filesystems (like /proc, /sys, and any separate data partitions), giving a misleading total. Always use -x when you want only the root filesystem.
• Using df on a file path: df /some/file works, but it shows the filesystem containing that file, not the file’s size. To get a file’s size, use ls -lh or du -h on the file.

Alternatives and Related Tools

While df and du are the classic tools, there are modern alternatives that provide more user-friendly output:

• ncdu – an interactive TUI that lets you navigate directories and see sizes in a sortable list. It is a wrapper around du but with a much better interface.
• duf – a prettier df that shows colored bars and device types.
• pydf – a Python-based df with colored output.
• Graphical tools like Baobab (GNOME Disk Usage Analyzer) or Filelight provide visual representations of disk usage.

For scripting, df and du remain the most portable and reliable. They are POSIX-standard, so they work on any Unix-like system, including macOS and BSD (though options may differ slightly – for example, macOS du does not support --max-depth, but you can use du -d 1 instead).

Frequently Asked Questions

Why does df show more used space than du on the same directory?

Because df reports the entire filesystem’s used blocks, including reserved space, metadata, and any deleted-but-open files. du only counts the data in files you can access. The difference is normal and usually small, but if it is huge, check for open deleted files with lsof | grep deleted.

How do I find the largest directories on my Linux system?

Run sudo du -x -h --max-depth=1 / 2>/dev/null | sort -h -r | head -20. This lists the top 20 largest directories on the root filesystem. Replace / with any mount point to analyze that filesystem.

What does the ‘reserved blocks’ percentage on ext4 mean?

By default, ext4 reserves 5% of the filesystem for the root user. This ensures that even if a user fills the disk, the system can still write critical files (like logs) and the root user can recover. You can change it with tune2fs -m, but reducing it is not recommended for system partitions.

Why does du show 4.0K for a file that contains only one character?

Files are stored in fixed-size blocks. On most filesystems, the block size is 4,096 bytes. Even a 1-byte file occupies one full block, so du reports 4.0K. This is the disk usage, not the file size.

Can I use df and du on Windows?

Not directly, but Windows has equivalent commands: wmic logicaldisk get size,freespace or PowerShell’s Get-PSDrive for disk free space, and du is available in Git Bash or WSL. For a native GUI, right-click a drive and choose Properties.

Is it safe to delete files that du shows as large?

Yes, du only reports sizes; it does not delete anything. However, before deleting, verify what the directory is for. Use du -h --max-depth=1 to drill down, and check with ls -la to see file names and modification times. Common safe candidates are old logs, cache directories, and temporary files.

Related

• MW4 Campaign Branches vs Black Ops 6 Choices
• HP’s History of Innovation: 10 Products That Changed Everything
• CDMA vs GSM: Key Differences Explained