How to Monitor Disk Usage with df, du, lsblk and ncdu on RHEL 7

How to Monitor Disk Usage with df, du, lsblk and ncdu on RHEL 7

Running out of disk space is one of the most disruptive events in a production Linux environment — it can crash databases, halt web servers, and fill system logs with errors. Proactive disk usage monitoring is therefore a non-negotiable part of RHEL 7 system administration. Red Hat Enterprise Linux 7 provides several powerful built-in tools for understanding disk layout and consumption: df for filesystem-level usage, du for directory-level analysis, lsblk and fdisk for block device inventory, and ncdu (available from EPEL) for an interactive, navigable view. This tutorial covers all of these tools along with practical scripting techniques for automated monitoring.

Prerequisites

• RHEL 7 system with root or sudo access.
• EPEL repository enabled (for ncdu): yum install -y epel-release.
• Basic command-line familiarity.

Step 1: Checking Filesystem Usage with df

The df (disk free) command reports the amount of disk space used and available on all mounted filesystems. It is the first command to run when investigating a “disk full” situation.

# Human-readable output (KB, MB, GB instead of 1-KB blocks)
df -h
# Filesystem               Size  Used Avail Use% Mounted on
# /dev/mapper/rhel-root     50G   18G   33G  36% /
# devtmpfs                 3.8G     0  3.8G   0% /dev
# tmpfs                    3.9G  8.0K  3.9G   1% /dev/shm
# tmpfs                    3.9G  9.4M  3.8G   1% /run
# tmpfs                    3.9G     0  3.9G   0% /sys/fs/cgroup
# /dev/sda1                497M  127M  371M  26% /boot
# /dev/mapper/rhel-home     20G  1.5G   19G   8% /home

# Show all filesystems including special virtual filesystems
df -ah

# Show filesystem type
df -hT
# Filesystem              Type  Size  Used Avail Use% Mounted on
# /dev/mapper/rhel-root   xfs    50G   18G   33G  36% /

# Show inode usage (runs out independently of block space)
df -i
# Filesystem               Inodes IUsed  IFree IUse% Mounted on
# /dev/mapper/rhel-root   26214400 98432 26115968    1% /

# Show only local filesystems (exclude NFS, tmpfs etc.)
df -hl

# Show specific filesystem
df -h /var/log

Pay attention to both block usage (the default) and inode usage (-i). A filesystem can reach 100% inode utilisation while still having free blocks — a situation that produces “No space left on device” errors even when df -h shows free space.

Step 2: Analysing Directory Usage with du

While df tells you how full a filesystem is, du (disk usage) tells you where the space is being used within the directory tree.

# Show total size of a directory in human-readable format
du -sh /var/log
# 2.3G    /var/log

# Show sizes of all subdirectories one level deep
du -h --max-depth=1 /var
# 16K     /var/adm
# 12K     /var/cache
# 8.0K    /var/crash
# 2.3G    /var/log
# 120M    /var/lib
# 2.6G    /var

# Show sizes of immediate subdirectories, sorted by size (largest first)
du -h --max-depth=1 /var | sort -rh
# 2.6G    /var
# 2.3G    /var/log
# 120M    /var/lib
# ...

# Show cumulative size of all subdirectories recursively
du -h /var/log | sort -rh | head -20

# Exclude certain directories
du -sh --exclude="/proc" --exclude="/sys" /

# Show only the grand total for a directory
du -sh /home/*
# 452M    /home/john
# 1.1G    /home/jane
# 23M     /home/deploy

Step 3: Viewing Block Devices with lsblk

The lsblk command lists block devices in a tree format, showing disks, partitions, LVM volumes and their mount points. It is the fastest way to get an overview of the storage layout on a system.

# Basic block device listing
lsblk
# NAME            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
# sda               8:0    0   80G  0 disk
# ├─sda1            8:1    0  500M  0 part /boot
# └─sda2            8:2    0 79.5G  0 part
#   ├─rhel-root   253:0    0   50G  0 lvm  /
#   ├─rhel-swap   253:1    0    8G  0 lvm  [SWAP]
#   └─rhel-home   253:2    0 21.5G  0 lvm  /home
# sr0              11:0    1  4.2G  0 rom

# Show filesystem type and UUID for each device
lsblk -f
# NAME           FSTYPE      LABEL UUID                                 MOUNTPOINT
# sda
# ├─sda1         xfs               3e4e5f78-...                         /boot
# └─sda2         LVM2_member       6a3d7c11-...
#   ├─rhel-root  xfs               1b2c3d4e-...                         /
#   └─rhel-home  xfs               5f6a7b8c-...                         /home

# Show size in bytes, and more detail
lsblk -b -o NAME,SIZE,TYPE,MOUNTPOINT

# Output in JSON format (useful for scripting)
lsblk -J

Step 4: Partition and Disk Details with fdisk

The fdisk command provides more detailed disk and partition information, including partition types and disk geometry.

# List all disks and partitions with sizes
fdisk -l
# Disk /dev/sda: 85.9 GB, 85899345920 bytes, 167772160 sectors
# Units = sectors of 1 * 512 = 512 bytes
# Sector size (logical/physical): 512 bytes / 512 bytes
# I/O size (minimum/optimal): 512 bytes / 512 bytes
# Disk label type: dos
# Disk identifier: 0x000abc12
#
#    Device Boot      Start         End      Blocks   Id  System
# /dev/sda1   *        2048     1026047      512000   83  Linux
# /dev/sda2         1026048   167772159    83373056   8e  Linux LVM

# Show details for a specific disk
fdisk -l /dev/sda

# For GPT disks, use gdisk or parted for better output
parted /dev/sda print

Step 5: Finding Large Files with find

When du identifies a directory consuming excessive space, find can pinpoint the individual large files responsible.

# Find files larger than 100 MB anywhere on the system
find / -type f -size +100M -ls 2>/dev/null

# Find files larger than 1 GB
find / -type f -size +1G -ls 2>/dev/null

# Find large files under a specific directory, sorted by size
find /var -type f -size +50M -printf '%st%pn' 2>/dev/null | sort -rn | head -20

# Find the 20 largest files on the filesystem
find / -xdev -type f -printf '%st%pn' 2>/dev/null | sort -rn | head -20

# Find old log files consuming space
find /var/log -name "*.log" -type f -size +10M -mtime +30 -ls

# Find core dump files
find / -name "core" -type f -ls 2>/dev/null
find / -name "*.core" -type f -ls 2>/dev/null

# Find zero-byte files (useful for cleanup)
find /tmp -type f -empty -ls 2>/dev/null

Step 6: Installing and Using ncdu from EPEL

ncdu (NCurses Disk Usage) is an interactive, text-based disk usage browser that makes navigating large directory trees much easier than repeated du commands. It is available from the EPEL repository.

# Enable EPEL repository if not already done
yum install -y epel-release

# Install ncdu
yum install -y ncdu

# Scan and browse a directory interactively
ncdu /var

# Scan from the root filesystem (skip other mounted filesystems)
ncdu -x /

# Scan a directory and save results to a file (useful for slow disks)
ncdu -o /tmp/disk-report.json /var

# Load a previously saved report
ncdu -f /tmp/disk-report.json

Inside the ncdu interface, use these keyboard shortcuts:

• Arrow keys / hjkl — Navigate the file list.
• Enter — Open a directory.
• d — Delete the selected file or directory (with confirmation prompt).
• n — Sort by name; s — Sort by size (default); C — Sort by item count.
• i — Show information about the selected item.
• q — Quit.
• ? — Show help.

Step 7: Understanding /proc/mounts

The /proc/mounts file is a real-time view of all currently mounted filesystems maintained by the kernel. It is the authoritative source of mount information and is more reliable than /etc/fstab (which shows desired mounts, not actual ones).

# View all current mounts
cat /proc/mounts
# sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
# proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
# devtmpfs /dev devtmpfs rw,nosuid,size=3997800k,nr_inodes=999450,mode=755 0 0
# /dev/mapper/rhel-root / xfs rw,relatime,attr2,inode64,noquota 0 0
# /dev/sda1 /boot xfs rw,relatime,attr2,inode64,noquota 0 0

# Find which filesystem a specific path belongs to
findmnt /var/log
# TARGET SOURCE             FSTYPE OPTIONS
# /      /dev/mapper/rhel-root xfs    rw,relatime,...

# Show mount tree
findmnt --tree

# Check mount options for a specific device
findmnt /dev/sda1

Step 8: Automating Disk Space Monitoring with a Script

A simple shell script scheduled with cron provides early warning before disk usage becomes critical.

# Create disk space monitoring script
cat > /usr/local/bin/disk-check.sh </dev/null; then
    ALERT=1
    MESSAGE="${MESSAGE}WARNING: ${DEVICE} mounted on ${MOUNT} is at ${USAGE}% capacityn"
  fi
done <  /etc/cron.d/disk-check

# Test manually
/usr/local/bin/disk-check.sh

Conclusion

Effective disk usage management on RHEL 7 requires layered visibility: lsblk and fdisk -l for the physical storage inventory, df -h for filesystem-level free space (and df -i for inodes), du -sh for directory-level analysis, find for hunting specific large or old files, and ncdu for an interactive deep-dive. Combine these tools with a cron-scheduled monitoring script that emails alerts when usage thresholds are exceeded, and you will catch disk space problems long before they affect production services. Remember to monitor both block usage and inode usage — both can cause “disk full” conditions — and pay particular attention to /var/log, /tmp, and application data directories which tend to accumulate the most unbounded growth.