Context & Why It Matters
Disk usage hits 95% at 2 AM. Your PagerDuty alarm goes off incessantly. It is a familiar nightmare for any sysadmin. By reflex, the first command you type into the terminal is df -h to identify which partition is choked up. That is usually followed by a tedious chain of commands: du -sh /* 2>/dev/null | sort -hr.
This traditional approach suffers from two fatal flaws. First, the du command creates severe I/O bottlenecks. On HDDs or massive multi-terabyte storage volumes, running it can easily throttle the entire server. Second, the terminal spits out a cluttered, chaotic wall of text. Every time you want to inspect a deeper subdirectory, you have to rerun the command again and again.
Early in my career, I learned this lesson the hard way on a production MySQL server. The /var partition was pinned at 100%. In a panic, struggling to parse the messy output from du, I accidentally deleted the mysql.sock socket file instead of a runaway 40GB binary log (binlog). The database crashed, causing over 45 minutes of painful, unnecessary downtime.
After that incident, I immediately added duf and ncdu to our standard server provisioning baseline across all production environments:
- duf (Disk Usage/Free Utility): The ultimate modern replacement for
df. It automatically organizes and groups physical disks, remote NFS mounts, and virtual memory filesystems (tmpfs). The output is rendered in clean, color-coded tables with intuitive progress bars. - ncdu (NCurses Disk Usage): A massive upgrade over
dufeaturing an interactive TUI (Text User Interface). It lets you navigate your directory tree using arrow keys, monitor disk consumption in real time, and purge junk files right on the spot.
Installation
Both utilities are written in high-performance languages (ncdu in C/Zig, duf in Go). They consume negligible memory and are available in the official repositories of most distributions.
1. On Ubuntu / Debian
sudo apt update
sudo apt install -y ncdu duf
If you are running an older release (such as Ubuntu 20.04 LTS, where duf is not present in the default apt repos), you can install the binary directly from GitHub releases:
curl -LO https://github.com/muesli/duf/releases/download/v0.8.0/duf_0.8.0_linux_amd64.deb
sudo dpkg -i duf_0.8.0_linux_amd64.deb
rm -f duf_0.8.0_linux_amd64.deb
2. On RHEL / Rocky Linux / AlmaLinux
For RHEL-based distributions, enable the EPEL repository before installing ncdu:
sudo dnf install -y epel-release
sudo dnf install -y ncdu
Install duf via the official RPM package:
sudo dnf install -y https://github.com/muesli/duf/releases/download/v0.8.0/duf_0.8.0_linux_amd64.rpm
3. On Arch Linux
sudo pacman -S ncdu duf
Detailed Configuration and Production Tips
Now that both tools are installed, let us put them to work in real-world troubleshooting scenarios.
1. Getting the Big Picture with duf
Simply running duf displays an overview of all storage mounts: Local Devices, Inaccessible Devices, and Special Devices. However, on production servers, you generally want to focus strictly on physical drives storing actual data.
Filter out virtual devices and pseudo-filesystems (such as snap squashfs and tmpfs):
duf --only local
Sort partitions in descending order by disk usage to spot hotspots immediately:
duf --sort used
Check inode utilization:
duf --inodes
This flag is a lifesaver in deceptive situations: your system throws “No space left on device” errors, yet df still reports tens of gigabytes of free disk space. The culprit is almost always an application generating millions of empty 0-byte cache or session files, exhausting the inode allocation table.
Pro tip: I keep a permanent alias configured in ~/.bashrc for everyday use:
echo 'alias df="duf --only local"' >> ~/.bashrc
source ~/.bashrc
2. Pinpointing and Cleaning Up Bottlenecks with ncdu
Once duf highlights which partition is running out of space, use ncdu to drill down and track down the offending directories or files.
Safely scan the root filesystem:
sudo ncdu -x /
Crucial note on the -x (one filesystem) flag: This parameter restricts ncdu to scanning only within the current filesystem. It prevents the scanner from traversing onto other mount points such as external drives, NFS network shares, or virtual pseudofilesystems like /proc and /sys. Omitting this flag can cause infinite scan loops or trigger unnecessary memory exhaustion.
Speed up scans by skipping bulky container runtime directories:
sudo ncdu -x --exclude /var/lib/docker/overlay2 /
3. Essential Keyboard Shortcuts for ncdu
Inside the interactive ncdu TUI, you can navigate your filesystem efficiently via the keyboard:
- Up / Down arrows (or j / k): Navigate between files and directories.
- Enter (or Right arrow): Open the selected directory.
- Left arrow: Return to the parent directory.
- d: Delete the selected file or folder. A confirmation prompt appears before performing permanent deletion.
- g: Toggle graphical usage representation (Graph): percentage, bar graph, or disabled completely.
- i: Show detailed file information: absolute path, inode count, and permissions.
- n: Sort entries alphabetically by name.
- s: Sort entries by size (default: largest to smallest).
- q: Exit the program.
4. Offline Scanning for High-Load Servers
Actively navigating deep directory structures on a live production server can hold disk I/O for extended periods. When dealing with systems handling thousands of requests per second, run a single scan, export the data to a compressed archive, and inspect it offline:
# Perform a single scan and export to a gzip archive (-1 scans once and exits immediately)
sudo ncdu -1xo- /var/log | gzip > /tmp/ncdu_var_log.json.gz
# Read and navigate the data without incurring any additional disk reads
zcat /tmp/ncdu_var_log.json.gz | ncdu -f -
Post-Cleanup Verification & Monitoring
After purging dozens of gigabytes of stale logs, resist the urge to close your SSH session immediately. You must verify whether the operating system has actually reclaimed the allocated disk space.
1. Re-verifying Available Disk Capacity
Run a quick duf check to see the updated metrics:
duf --only local
2. Trapping Deleted Open Files
You just deleted a 30GB access.log with ncdu, but duf still indicates that free space has not increased by a single byte? Don’t panic. An active Nginx process still holds an open file descriptor pointing to it. Linux only releases physical storage blocks once the holding process releases its file handle.
Quickly identify which processes are still holding unlinked files:
sudo lsof +L1 | grep '(deleted)'
This command outputs the PID and name of the associated service. Simply instruct the service to release the file handle:
sudo systemctl reload nginx
Run duf once more, and you will see your reclaimed gigabytes instantly restored to the pool of free space.
3. Integrating Automated Alerts via JSON
A standout capability of duf is native output support via the --json flag. This makes writing lightweight bash monitoring scripts for Slack, Telegram, or email notifications remarkably straightforward:
#!/usr/bin/env bash
set -euo pipefail
# Retrieve disk usage percentage for the root partition (/)
USAGE=$(duf --json | jq '.[] | select(.mount_point=="/") | .used_percent')
if (( $(echo "$USAGE > 90" | bc -l) )); then
echo "Warning: Root partition / usage has hit ${USAGE}% on $(hostname)!" | mail -s "[Disk Alert] $(hostname) disk almost full" [email protected]
fi
By pairing duf for high-level infrastructure visibility with ncdu for granular directory investigation, you will save hours of tedious manual troubleshooting whenever a server faces a disk space emergency.
