df tells you the disk is full. du tells you what is filling it.
df just told you the disk is 95% full — now you have to find the culprit. du is the only command that walks the tree and tells you exactly which directory is eating your gigabytes.
du (disk usage) reports how much disk space a file or directory tree consumes. Point it at a directory and it walks every subdirectory, summing the sizes. It is the natural partner to df: df says which filesystem is full, du says which files and folders are filling it. The default output is in 1K blocks, so the first thing everyone does is add -h for human-readable sizes.
When a disk fills up, du is your forensic tool. `du -h --max-depth=1 /var | sort -h` reveals the biggest subdirectory in seconds, and `du -ah | sort -h | tail` names the single largest file. It is also how you check whether a cache directory is worth clearing, or whether that 'small' backup is actually eating 20 gigabytes.
du -sh dutest
$ du -sh dutest 71M dutest
-s summarizes to a single total, -h makes it human-readable. One line: the whole tree is 71M.
du -h --max-depth=1 dutest | sort -h
$ du -h --max-depth=1 dutest | sort -h 8.0K dutest/src 21M dutest/backups 51M dutest/cache 71M dutest
--max-depth=1 limits the walk to one level, and sort -h orders by size. The cache directory is the obvious culprit at 51M.
du -ah dutest | sort -h | tail -5
$ du -ah dutest | sort -h | tail -5 20M dutest/backups/old.tar 21M dutest/backups 50M dutest/cache/big.db 51M dutest/cache 71M dutest
-a includes individual files. Sorting and taking the tail names the single biggest file: cache/big.db at 50M.
du -sh /var/cache/apt
$ du -sh /var/cache/apt 1.2G /var/cache/apt
A real-world check: is the apt cache worth clearing? 1.2G of downloaded .deb files — `apt clean` would reclaim it.
| Flag | Meaning |
|---|---|
-h | human-readable sizes (K, M, G) instead of 1K blocks |
-s | summarize — print only the grand total, not every subdirectory |
-a | include individual files, not just directories |
--max-depth=N | limit the walk to N levels deep |
-c | print a grand total in addition to per-directory sizes |
-x | stay on one filesystem; don't cross mount points |
-d N | shorthand for --max-depth=N |
du has been part of Unix since the 1971 first edition, the same release that gave us df. Its name is a contraction of 'disk usage'. For over fifty years its job has been unchanged: walk a directory tree and report how much space it consumes. It is one of the oldest surviving commands in the Unix toolbox.
du reports the number of disk blocks a file occupies, not its logical byte size. A 1-byte file still takes a full 4K block on most filesystems, so du can show a file as larger than its ls size. That is why du and ls -l sometimes disagree — du counts the real disk footprint, including the slack space at the end of each block.