How to Diagnose and Free Unexpected Linux Disk Space Usage

Background

During routine server maintenance, administrators often receive alerts that disk space is running low. The first step is to verify the current usage with df -Hl, which shows the total, used, and available space on each mounted filesystem.

Finding Large Directories and Files

A simple but slow method is to run du -hs * in the root directory and then repeat the process in sub‑directories until the culprit is found.

A more efficient approach uses du with depth limits and filters for large sizes:

du -h -d 2 | grep [GT] | sort -nr

du -h --max-depth=2 | grep [GT] | sort -nr

These commands list directories up to two levels deep, keep only those whose size is expressed in gigabytes (G) or terabytes (T), and sort them in descending order.

Alternatively, find can directly locate large files:

find / -type f -size +1G -exec du -h {} \;

find

is generally faster and more flexible than du for this purpose.

When df and du Totals Differ

Sometimes the sum of sizes reported by du is far less than the usage shown by df. This discrepancy is often caused by files that have been deleted but are still held open by a running process.

To identify such files, use lsof +L1: lsof +L1 The output may reveal, for example, a 28 GB log file that has been removed from the filesystem but remains open, consuming space.

Stopping or restarting the associated service (e.g., a Tomcat application) releases the file descriptor and frees the space.

Reserved Space for the Root User

Linux filesystems reserve a percentage of total space (default 5%) for the root user to ensure critical services can continue operating when the disk is otherwise full.

If this reserved space appears to be “missing” from the usable capacity, you can adjust it with tune2fs: tune2fs -m 1 /dev/vda1 Setting the reserved percentage to 1 % reduces the hidden allocation, as shown in the before/after screenshots.

Conclusion

By combining df, du, find, lsof, and tune2fs, you can quickly pinpoint the directories or files that consume unexpected disk space, resolve discrepancies caused by deleted but open files, and fine‑tune reserved space to keep your Linux server storage healthy.