Linux · Systems fluency

How do you diagnose disk usage problems?

Mediumdisk-usagedfinodesUpdated Oct 2026
Quiz this track

Short answer

df reports filesystem-level usage, while du sums file sizes. A full filesystem can be caused by large files, deleted-but-open files, reserved blocks, or inode exhaustion even when bytes appear free.

Start with df -h to see which filesystem is full, then df -i to check inode exhaustion. Use du on the affected mount, one level at a time, to find the directory responsible. Stay on one filesystem with -x to avoid double counting mounts.

sh
df -h
df -i
du -xhd1 /var | sort -h
lsof +L1

Why df and du disagree

  • A process holds a deleted file open, so the blocks remain allocated
  • Filesystem reserved blocks are not available to normal users
  • du counts hard-linked files once, while df counts allocated blocks
  • Container overlay filesystems may report host-level storage
  • Logs rotated but not reopened keep consuming space

Find the largest consumers with du, then inspect with ncdu for interactive exploration. If df shows space used but du finds nothing, look for deleted open files and restart or signal the holding process.

Do not delete random files under /var to free space. Remove or rotate logs through the supported mechanism, and verify that the service reopens its files.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why can df report a full disk while du shows little usage?
  2. 2How do you check for inode exhaustion?
  3. 3What does lsof +L1 find?
  4. 4How do you safely free space from a busy log directory?

Say it in the interview

I start with df to identify the full filesystem and df -i for inodes. Then I use du one level at a time with -x to find the growth. If df and du disagree, I check for deleted files still held open by a process. I free space through supported rotation rather than deleting arbitrary files.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Linux mock interview and get scored feedback on depth, clarity and confidence.