As a Linux system administrator managing servers under heavy production loads, understanding your storage utilization is critical. The df command is your first line of defense when it comes to monitoring disk space and inodes on Linux systems. This built-in utility offers a quick snapshot of mounted filesystems, helping you gauge available space and prevent outages caused by disk exhaustion. In this article, we’ll dissect the df command from the ground up, explain how it interprets disk and inode usage, and share real-life fixes for common filesystem pitfalls. Whether you are running Debian, Ubuntu, CentOS, or RHEL, mastering df is essential for vibrant, healthy servers without surprises.

Understanding the df Command and Its Output

At its core, the df command reports how much disk space is used and available on all mounted filesystems. It shows six fundamental pieces of information: the filesystem name, its size, used space, available space for non-root users, percentage of use, and the mount point. Here’s a typical example:

df

Filesystem     1K-blocks    Used Available Use% Mounted on
/dev/sda1      101901904 5739840  89592760   7% /
tmpfs            1638432       0   1638432   0% /dev/shm
/dev/sdb1      204828356 82543824 111284532  43% /data

This output tells us that /dev/sda1 is our root partition mounted at /. It’s 101GB in size, with about 5.7GB used. The tmpfs entry shows zero usage—it’s an in-memory temporary filesystem. Lastly, /dev/sdb1 is a separate data partition.

A nuanced detail every sysadmin should know: the Available size isn’t simply the total size minus the used space. Linux reserves around 5% of each filesystem’s space for the root user. This reserved space prevents the system from crashing when the disk is full for normal users, allowing root-level repair and space reclamation. This means Used + Available typically doesn’t add up to the total filesystem size.

Practical Usage: The Most Common df Options

While the raw output from df gives the data in blocks (usually 1K blocks), most admins prefer human-readable formats. That’s where flags become critical.

df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       97G   5.5G   86G   7% /
tmpfs           1.6G  0     1.6G   0% /dev/shm
/dev/sdb1      196G   79G   106G  43% /data

The -h flag converts sizes to human-friendly formats: KB, MB, GB, or TB, picking the optimal unit per file system. This makes glancing at disk usage both easier and quicker.

One of the many situations I run into: servers where the disk usage suddenly shoots up to 90% or more. Treat anything above 85% as a warning sign, and 95%+ often means urgent cleanup or risk of failure.

Checking Filesystem Types and Inodes

When working on mixed environments with ext4, xfs, or btrfs filesystems, it’s useful to know which filesystem type each partition uses. Combine the -T flag to show this alongside usage:

df -hT

Filesystem     Type     Size  Used Avail Use% Mounted on
/dev/sda1      ext4      97G   5.5G   86G   7% /
/dev/sdb1      xfs      196G    79G  106G  43% /data
tmpfs          tmpfs    1.6G    0    1.6G   0% /dev/shm

This is instrumental when planning resizing, tuning, or repairs specific to filesystem types.

Another important resource to check is inode availability. Inodes hold metadata about files and directories, and inode exhaustion can cause “No space left on device” errors even if disk space is available. To check inode usage:

df -ih

Filesystem     Inodes  IUsed  IFree  IUse% Mounted on
/dev/sda1      6100000  256000 5840000   5% /
/dev/sdb1      13000000 12000000 1000000  92% /data

In this example, /dev/sdb1 has dangerously high inode usage at 92%. This is a red flag for systems with many small files, such as log directories, mail queues, or cache folders. If you ignore inode exhaustion, your applications might start failing even though df -h reports free space.

Filtering, Sorting, and Customizing df Output

In daily administration, you might only care about one type of filesystem or want to hide clutter like temporary filesystems (tmpfs) that are usually irrelevant to disk limits.

To filter output showing only filesystems of a certain type (e.g., ext4):

df -t ext4 -h

Filesystem     Size  Used Avail Use% Mounted on
/dev/sda1       97G   5.5G   86G   7% /
/dev/sdc1       50G   10G    38G  21% /backup

Or to exclude tmpfs from results for a cleaner view:

df -x tmpfs -h

Filesystem     Size  Used Avail Use% Mounted on
/dev/sda1       97G   5.5G   86G   7% /
/dev/sdb1      196G    79G  106G  43% /data

One handy trick I often use is sorting output by usage percentage so the most critical filesystems show up on top:

df -h | sort -k5 -rn

Filesystem      Size Used Avail Use% Mounted on
/dev/sdb1      196G   79G  106G  43% /data
/dev/sda1       97G  5.5G   86G   7% /
tmpfs          1.6G    0  1.6G   0% /dev/shm

This quick view is a lifesaver when juggling many disks or partitions on high-density servers.

Best Practices for Effective Disk and Inode Monitoring

In real production environments, disk availability often becomes a silent risk factor if not monitored and managed proactively. Here are some best practices that I recommend:

  • Automate monitoring and alerts: Schedule scripts or use monitoring tools that run df -h checks regularly, triggering alerts above 80-85% disk or inode usage.
  • Check both disk space and inodes: Disk space might look fine, but inode depletion can break applications. Always monitor both.
  • Understand filesystem reservations: Reserved space (5% by default) helps emergency root access; adjust cautiously with tune2fs if needed.
  • Clean up logs and cache periodically: Many inode-related problems arise from runaway log files or cache directories filling up.
  • Combine df and du commands: Use df for overall status and du -sh to identify directories hogging space.

One useful trick many administrators overlook is using watch to monitor disk space in real-time during large file transfers or backups:

watch -n 5 df -h

Every 5.0s: df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       97G   5.6G   85G   7% /
/dev/sdb1      196G   80G  105G  44% /data

This live feedback has saved me multiple times from running out of disk unexpectedly during lengthy copy operations.

Troubleshooting Scenario: Disk Space Mismatch and Hidden Usage

A mistake I often see when managing Linux servers is disk space reported as full, yet running du shows no large files to delete. This usually happens because files have been deleted but are still held open by a running process, preserving disk space until the process closes the file descriptor.

Example:

df -h /var

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       50G    49G  1G    98% /var

du -sh /var/*

2G     /var/log
1G     /var/tmp
10M    /var/lib

The total disk usage reported by du is much less than what df reports. This indicates a deleted but still opened file.

To find such files, use lsof (List Open Files):

lsof +L1

COMMAND   PID  USER   FD   TYPE DEVICE SIZE/OFF NLINK NODE NAME
rsyslogd  1234 root    4w   REG  8,1  1234567 0      12345 /var/log/messages (deleted)

Restarting the related service (in this case, rsyslogd) releases the file handle and frees disk space. This fix prevents downtime and corrupted logs.

Conclusion

The df command is fundamental for Linux system administrators aiming to maintain disk health and uptime for production servers. Beyond showing raw disk usage, combining flags like -h, -T, and -i empowers you to monitor disk space and inode consumption accurately. Proactive monitoring, informed by df data, helps catch imminent disk exhaustion before it escalates into application failures or server downtime. Remember, disk management is not just about free space — inode availability and hidden open files equally matter. Pairing df with complementary tools like du and lsof, along with incorporating real-time tracking, will elevate your Linux administration skills and keep your servers running smoothly.