Running out of disk space is one of the most disruptive failures a server can experience. When a filesystem fills up, applications crash, log files stop writing (losing audit trails), databases corrupt transactions, and web servers return 500 errors. Proactive disk monitoring is essential — and RHEL 9 provides a full set of tools for understanding exactly where your disk space is going. df gives a filesystem-level overview; du drills down into directory hierarchies; lsblk shows the block device tree from physical disks to partitions to mounted filesystems; ncdu provides an interactive disk usage browser. Together these tools let you quickly answer “which directory is consuming 40 GB?” and “which filesystem is at 98%?” This guide covers all four tools plus finding large files, monitoring inode usage, and setting up automated disk usage alerts.

Prerequisites

  • RHEL 9 server with root or sudo access
  • EPEL repository enabled (for ncdu)

Step 1 — Monitor Filesystem Usage with df

df (disk free) shows usage statistics for each mounted filesystem:

# Human-readable output (KB, MB, GB)
df -h

# Show all filesystems including tmpfs
df -ha

# Show a specific filesystem
df -h /var

# Show inode usage instead of block usage
df -i

# Show filesystem type as well
df -hT

Sample output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   38G  9.4G  81% /
/dev/sda2       200G  142G   47G  76% /var
tmpfs           3.9G     0  3.9G   0% /dev/shm

The Use% column is your early warning indicator. Set alerts when any filesystem exceeds 80%.

Step 2 — Find Large Directories with du

du (disk usage) recursively calculates the size of directories:

# Show disk usage of the current directory (one level deep)
du -sh *

# Show all subdirectories recursively
du -h /var

# Sort by size and show the top 10 largest directories
du -h /var --max-depth=2 | sort -hr | head -10

# Show total size of a specific directory
du -sh /var/log

# Show sizes of all immediate subdirectories of /var
du -sh /var/*/

# Exclude certain paths
du -sh /var --exclude=/var/lib/docker

Step 3 — Find the Largest Files on the System

# Find the 20 largest files under /var
find /var -type f -printf '%s %pn' 2>/dev/null | sort -rn | head -20 | 
    awk '{printf "%.1f MBt%sn", $1/1048576, $2}'

# Find files larger than 1 GB anywhere
find / -type f -size +1G -exec ls -lh {} ; 2>/dev/null

# Find files larger than 100 MB in /var/log
find /var/log -type f -size +100M -ls 2>/dev/null

# Find files that have not been accessed in 90 days (candidates for cleanup)
find /home -type f -atime +90 -ls 2>/dev/null | head -20

Step 4 — Understand Block Device Layout with lsblk

lsblk shows the tree of block devices — disks, partitions, LVM volumes, and their mount points:

# Basic tree view
lsblk

# Show filesystem type, UUID, and label
lsblk -f

# Show size in bytes
lsblk -b

# Show all columns
lsblk -a -o NAME,SIZE,TYPE,MOUNTPOINT,FSTYPE,UUID

Sample output:

NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda           8:0    0  256G  0 disk
├─sda1        8:1    0    1G  0 part /boot
└─sda2        8:2    0  255G  0 part
  ├─vg0-root 253:0   0   50G  0 lvm  /
  ├─vg0-var  253:1   0  200G  0 lvm  /var
  └─vg0-swap 253:2   0    4G  0 lvm  [SWAP]

Step 5 — Use ncdu for Interactive Disk Usage Browsing

ncdu (NCurses Disk Usage) is an interactive terminal browser that makes it easy to visually navigate a directory tree and identify what is using space:

dnf install -y ncdu

# Scan current directory
ncdu

# Scan a specific path
ncdu /var

# Scan the entire filesystem (exclude other mount points)
ncdu -x /

While in ncdu:

  • Arrow keys navigate, Enter opens a directory
  • d — delete the selected item (with confirmation)
  • n — sort by name, s — sort by size
  • q — quit

Step 6 — Monitor Inode Usage

A filesystem can run out of inodes while still having free blocks. This happens when a directory contains millions of small files (common with email spools, session files, and cache directories):

# Check inode usage
df -i

# Find directories with the most files
find / -xdev -printf '%hn' 2>/dev/null | sort | uniq -c | sort -rn | head -10

If a filesystem has 100% inode usage, you will see “No space left on device” errors even with gigabytes of free blocks. The fix is to delete files (not add more space).

Step 7 — Set Up Automated Disk Usage Alerts

Create a monitoring script that emails an alert when any filesystem exceeds a threshold:

vi /usr/local/bin/disk-alert.sh
#!/bin/bash
THRESHOLD=80
[email protected]
HOSTNAME=$(hostname -f)

df -H | grep -vE '^Filesystem|tmpfs|cdrom|udev' | awk '{print $5 " " $6}' | while read -r usage mount; do
    use=$(echo "$usage" | sed 's/%//')
    if [ "$use" -ge "$THRESHOLD" ]; then
        echo "DISK ALERT on $HOSTNAME: $mount is at $usage" | 
            mail -s "Disk Space Alert: $mount at $usage on $HOSTNAME" "$ADMIN"
    fi
done
chmod +x /usr/local/bin/disk-alert.sh

# Schedule to check every 30 minutes
echo "*/30 * * * * root /usr/local/bin/disk-alert.sh" > /etc/cron.d/disk-alert

Step 8 — Clean Up Common Space Wasters

# Clean dnf package cache
dnf clean all

# Remove old kernel versions (keep the 2 most recent)
dnf remove --oldinstallonly --setopt installonly_limit=2 kernel

# Vacuum systemd journal logs (keep last 7 days)
journalctl --vacuum-time=7d

# Find and remove empty files
find /var/log -type f -empty -delete

# Find orphaned packages (installed as dependencies but no longer needed)
dnf autoremove

# List largest installed packages
rpm -qa --queryformat '%{SIZE} %{NAME}n' | sort -rn | head -20

Verification Checklist

# Filesystem overview
df -hT

# Inode usage
df -i

# Block device layout
lsblk -f

# Top 10 directories by size in /var
du -sh /var/*/ 2>/dev/null | sort -hr | head -10

Conclusion

You now have a complete disk monitoring toolkit on RHEL 9: df for filesystem-level overview, du for directory drilling, lsblk for understanding the block device layout, ncdu for interactive browsing, automated alerts for threshold breaches, and a cleanup checklist for reclaiming space. Proactive monitoring prevents the silent disk-full failures that crash databases and stop log collection at the worst possible moments.

Next steps: How to Use journalctl for Systemd Log Analysis on RHEL 9, How to Manage LVM Storage on RHEL 9, and How to Monitor System Resources with htop and vmstat on RHEL 9.