Linux disk space and inode investigation cheat sheet
Distinguish exhausted bytes, exhausted inodes, mount layout and directory growth before deleting any files.
Linux with GNU coreutils and util-linux. Commands inspect mounted filesystems and may take time on large directory trees.
Updated · Linux · 6 min read
| Command | What it does |
|---|---|
df -hT /var | Inspect filesystem byte capacity |
df -i /var | Inspect inode capacity |
findmnt -T /var | Identify the mount serving a path |
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINTS | Map block devices to filesystems |
du -xhd1 /var | Measure first-level directory byte usage |
du --inodes -x --max-depth=1 /var | Locate directories consuming many inodes |
Walkthrough
Replace /var with the affected path. Directory traversal may need additional read permissions. Stay on the selected filesystem when measuring; this workflow performs no cleanup or filesystem repair.
Step 1: Inspect filesystem byte capacity
df -hT /var
Read the filesystem, mountpoint, type, Available and Use% for this path. A full parent or separate mount can affect only part of the server. Human-readable rounded values are useful for triage; compare the same mount across samples.
Step 2: Inspect inode capacity
df -i /var
Check IFree and IUse% on filesystems with fixed inode accounting. A workload creating many tiny files can exhaust inodes while gigabytes remain free. Some filesystem types allocate metadata differently, so interpret these fields with their documentation.
Step 3: Identify the mount serving a path
findmnt -T /var
Record SOURCE, TARGET, FSTYPE and mount options. A read-only mount can explain write failures even when capacity remains. Compare the selected mount with the expected volume before attributing usage to a directory on another filesystem.
Step 4: Map block devices to filesystems
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINTS
Trace the mounted filesystem back to its disk, partition or logical device. A large disk does not mean the filesystem has been expanded to use it. MOUNTPOINTS availability depends on util-linux version; use MOUNTPOINT on older releases.
Step 5: Measure first-level directory byte usage
du -xhd1 /var
Compare the largest immediate directories while staying on one filesystem. du reports accessible linked files, whereas df reports filesystem allocation, so deleted-open files, metadata, reserved space and permission failures can explain a difference.
Step 6: Locate directories consuming many inodes
du --inodes -x --max-depth=1 /var
On GNU du, compare inode counts by immediate directory when df -i indicates pressure. A large count points toward many files rather than a single large log. Inspect the responsible application and its retention policy before authorizing cleanup.
WORKED INCIDENT
Practical case: An application says no space left despite free gigabytes
Fictional teaching scenario; observations are examples, not captured production output.
Situation
A queue worker cannot create new files under /var. The monitoring dashboard still shows several gigabytes free.
Investigation sequence
1. Inspect filesystem byte capacity
df -hT /varConfirm the failing path is on the filesystem represented in the dashboard.
2. Inspect inode capacity
df -i /varRead inode utilization. This example reports IFree = 0 despite available bytes.
3. Identify the mount serving a path
findmnt -T /varVerify the actual mount and options so a separate queue volume is not confused with the root filesystem.
4. Locate directories consuming many inodes
du --inodes -x --max-depth=1 /varCompare directory inode counts. The example concentrates millions of small entries under the application queue.
Example findings
Illustrative findings: Available = 8G; IUse% = 100%; the application queue dominates the inode count.
Interpret the findings
The immediate limit is inode availability, not byte capacity. Application retention or a stuck queue may explain growth; deleting arbitrary queue entries could lose work.
Verify the outcome
After the application owner performs approved retention or queue recovery, repeat df -i and the directory count. Confirm that a normal application operation creates and processes a new item.
Escalation handoff
Share the mount, inode samples, growth window and directory counts with the application/storage owners. If df and du disagree, ask for an investigation of deleted-open files and filesystem accounting.