du

What it does

du (disk usage) reports how much disk space specific files and directories are actually consuming, by walking the directory tree and summing block usage. Unlike df, which reports usage for an entire mounted filesystem, du answers "which of these directories or files is actually using the space," making it the standard tool for hunting down what's filling up a disk.

Beginner examples

• du /path — recursively list the size of every subdirectory under /path
• du -h /path — same, with human-readable sizes like 240M or 1.2G
• du -sh /path — collapse to a single total for /path
• du -ah /path — include individual files, not just directories
• du -sh * — total size of each item in the current directory

du -sh /var/log

Advanced examples

• Find the largest subdirectories one level deep: du -h --max-depth=1 /home | sort -h
• Sort output so the largest items appear last (easy to spot at the bottom of a terminal): du -h /var | sort -h
• Find the largest individual files under a path: du -ah /var/log | sort -rh | head -20
• Get a grand total across several paths: du -ch /var /home /tmp | tail -1
• Stay within one filesystem, ignoring mounted network shares or other filesystems: du -sxh /

du -h --max-depth=1 / 2>/dev/null | sort -h

Common mistakes

• Running du -h /path without -s on a huge tree and being overwhelmed by per-subdirectory output when only the total was wanted — add -s to summarize.
• Comparing du output directly to df output and expecting them to match exactly — they measure different things and can legitimately disagree.
• Forgetting -a when trying to find individual large files — by default du only reports directory totals, not per-file sizes.
• Sorting du -h output with plain sort instead of sort -h, which sorts alphabetically rather than by the human-readable size (1K would sort before 500M incorrectly without -h).
• Not accounting for permission errors when scanning system-wide (du -sh /) as a non-root user — redirect stderr with 2>/dev/null to suppress noisy "Permission denied" lines.

Tips

• Combine du -h --max-depth=1 with sort -h to quickly narrow down which top-level subdirectory is consuming the most space, then repeat one level deeper.
• Use -c to get a combined grand total when passing multiple paths at once.
• Use -x when you want disk usage confined to the current filesystem, e.g. to avoid du wandering into a large mounted network share.
• du -sh .[!.]* * 2>/dev/null is a handy pattern to include hidden files/directories alongside regular ones when summarizing the current directory.

Best practices

• Use du -sh for quick totals and du -h --max-depth=N | sort -h for drilling down — don't try to eyeball unsorted recursive output on large trees.
• When freeing up disk space, always cross-check du findings with df -h afterward to confirm the space was actually reclaimed at the filesystem level.
• Exclude filesystems you don't intend to scan with -x to avoid slow, unintentional scans of network mounts.
• In scripts, prefer du -sh on specific known paths over an unscoped scan of /, both for speed and to avoid permission-denied noise.

Real-world use cases

• Hunting down what's filling up /var when a server reports low disk space: du -h --max-depth=1 /var | sort -h.
• Auditing user home directories for the biggest space consumers before enforcing quotas.
• Checking how large a build artifact or Docker layer directory has grown: du -sh node_modules.
• Comparing log directory growth over time as part of routine log-rotation maintenance.

Common interview questions

• What's the difference between du and df? du reports space used by specific files or directories by walking the tree; df reports space usage for an entire mounted filesystem as tracked by the kernel. They measure different things and can disagree.
• How would you find the largest directories under a path? du -h --max-depth=1 /path | sort -h, then repeat one level deeper into whichever subdirectory is largest.
• Why might du -sh report more space than you expect from summing file sizes manually? du reports actual disk block usage, which rounds files up to the filesystem's block size and includes directory entry overhead, so it's typically larger than the sum of apparent file byte sizes.
• How do you get a single total for multiple directories? du -ch dir1 dir2 dir3, where -c adds a combined grand total line at the end.