7.5 Monitoring Disk Usage: df, du & tune2fs (104.2)

7.5 Monitoring Disk Usage: df, du & tune2fs

Quick Summary: Linux administrators monitor storage capacity and health using df (to evaluate overall filesystem capacity and inode consumption) and du (to track directory tree disk usage). For ext2/ext3/ext4 filesystems, the tune2fs utility enables administrators to inspect superblock parameters (-l) and modify settings—including volume labels (-L), UUIDs (-U), reserved root block percentages (-m), and error behaviors (-e)—on live systems without reformatting.

---

1. Filesystem Capacity Monitoring with df

The df (disk free) utility queries the superblock and kernel Virtual File System (VFS) statistics of all currently mounted filesystems to report available, used, and total storage capacity.

Command Syntax:
  df [options] [file|device...]

Essential df Command Flags Reference

# Display human-readable filesystem usage with filesystem types
$ df -hT
Filesystem     Type      Size  Used Avail Use% Mounted on
/dev/sda2      ext4       40G   18G   20G  48% /
/dev/sda1      vfat      512M   32M  480M   7% /boot/efi
/dev/sdb1      xfs       200G   45G  156G  23% /srv/data
tmpfs          tmpfs     7.8G     0  7.8G   0% /dev/shm

---

2. Inode Exhaustion & The df -i Metric

Every file, directory, and symbolic link created on an ext2/ext3/ext4 filesystem requires an inode to store its metadata. When an ext filesystem is created with mkfs.ext4, a fixed number of inodes is generated in the inode table.

The "No Space Left on Device" Inode Trap

If a service (such as an unmonitored mail server or session cache) creates millions of 0-byte or tiny files, it can consume 100% of available inodes while using almost none of the actual disk byte capacity. When this happens, any attempt to create a new file fails with No space left on device even though df -h shows gigabytes of free disk space!

# Diagnose inode exhaustion with df -i
$ df -i
Filesystem       Inodes   IUsed    IFree IUse% Mounted on
/dev/sda2       2621440 2621440        0  100% /var/spool/mail
/dev/sdb1      13107200  421090 12686110    4% /srv/data

💡 LPIC-1 Exam Fill-in-the-Blank Alert: What df command-line option displays filesystem inode usage statistics rather than block capacity? Answer: -i (or --inodes)

3. Directory & File Space Analysis with du

While df operates at the filesystem level, du (disk usage) measures the actual disk space consumed by directories and files by traversing the directory tree.

Command Syntax:
  du [options] [directory|file...]

Essential du Flags Reference

Practical du Commands for System Administration

# 1. Summarize total size of /var/log in human units
$ du -sh /var/log
4.2G	/var/log

# 2. Inspect space used by immediate subdirectories under /var (depth 1)
$ du -h --max-depth=1 /var
1.2G	/var/cache
4.2G	/var/log
850M	/var/lib
6.3G	/var

# 3. Identify the 5 largest directory consumers on the root filesystem (staying on one filesystem)
# du -xh / | sort -rh | head -n 5

The df vs. du Discrepancy (Deleted Open Files Trap)

A classic Linux administration dilemma occurs when df reports a partition is 100% full, but du -sh / calculates only 30% usage.

Root Cause: When a large file (e.g., a 50 GB log file) is deleted with rm while a running process (e.g., rsyslogd or Java) still holds an open file descriptor to it, the directory link is removed, but the inode and data blocks remain allocated on disk until the process terminates or closes the descriptor.

# Locate deleted files that are still held open in memory by running processes
# lsof +L1
# Or filter lsof for deleted entries:
# lsof | grep deleted
java    4810  root    3u   REG  8,2 52428800000     189204 /var/log/app.log (deleted)

# Resolution: Restart the holding service to release the disk blocks
# systemctl restart app-service

---

4. Superblock Inspection & Parameter Tuning with tune2fs

The tune2fs utility allows administrators to inspect and adjust tunable filesystem parameters on ext2, ext3, and ext4 filesystems without reformatting or destroying data.

Command Syntax:
  tune2fs [options] <device>

Essential tune2fs Command Options Reference

Practical Superblock Inspection with tune2fs -l

# Inspect superblock details of an ext4 filesystem
# tune2fs -l /dev/sda2
tune2fs 1.46.5 (30-Dec-2021)
Filesystem volume name:   ROOT_VOL
Filesystem UUID:          a28b12f4-7e11-42b8-a6d1-817290123456
Filesystem magic number:  0xEF53
Filesystem state:         clean
Errors behavior:          Remount read-only
Filesystem OS type:       Linux
Inode count:              2621440
Block count:              10485760
Reserved block count:     104857 (1.00%)
Free blocks:              6120491
Free inodes:              2410882
Block size:               4096
Mount count:              14
Maximum mount count:      30
Last checked:             Mon Aug 25 14:20:00 2026
Check interval:           15552000 (180 days)
Filesystem features:      has_journal ext_attr resize_inode dir_index filetype extent 64bit

---

5. Filesystem Volume Label Management Utilities

Volume labels allow disks to be identified and mounted persistently via LABEL=name in /etc/fstab rather than relying on shifting /dev/sd* device node names.

Label Management Tools Across Filesystem Types

# Set and view volume labels using e2label
# e2label /dev/sda2 SYS_ROOT
# e2label /dev/sda2
SYS_ROOT