df command in linux:Master disk space monitoring in 2026

As a system administrator, IT professional, or cybersecurity professional:

df command in linux helps you manage disk space effectively.

This article covers all aspects of df.

From basic syntax to advanced monitoring techniques.

Perfect for:

• WordPress site managers in India
• Linux sysadmins on production systems
• Anyone needing disk space insights

Table of Contents

1. What is the df Command in linux?
2. Basic Syntax & Usage df in linux
3. Essential Options of df command in linux
4. Beginner Examples for df in linux
5. Advanced Techniques of df in linux
6. df vs du Differences
7. Sysadmin Use Cases of df in linux
8. Scripting & Automation
9. Performance Tips
10. Troubleshooting of df in linux
11. Best Practices for df command in linux
12. Cybersecurity Uses
13. 20 Detailed FAQs

What is the df Command in Linux?

The df command, short for “disk free”:

Provides instant filesystem-level disk space usage.

Covers all mounted partitions on Linux/Unix systems.

Unlike du:

• du recursively analyzes individual directories
• df delivers high-level summaries

Shows for every filesystem:

• Total space
• Used space
• Available space
• Mount percentages

First command sysadmins run.

Investigates "No space left on device" errors.

---

For Indian hosting providers managing LAMP stacks:

df instantly reveals problematic partitions:

• /var
• /home
• /tmp

Part of GNU coreutils across:

• Ubuntu
• CentOS
• Debian
• Rocky Linux

Supports:

• Human-readable output
• Inode reporting
• Filesystem type filtering

Critical for 24/7 monitoring.

Prevents production outages.

Provides sub-second disk insights.

Maintains WordPress sites, databases, email servers.

Basic Syntax and Usage

Basic syntax: df [OPTIONS] [FILESYSTEM_LIST]

No arguments shows all mounted filesystems.

Columns displayed:

• Filesystem
• Size
• Used
• Available
• Use%
• Mounted on

Sample output:

• /dev/sda1: 50GB total
• 45GB used, 5GB available
• 90% utilization at "/"

Target specific filesystem:

df -h /var shows only /var partition details.

Human-readable: Converts bytes to GB/MB/KB.

Use% column alerts at 80% utilization or more.

df -h takes <0.1 seconds.

Unlike du recursive crawl.

Perfect first-step triage for disk crisis.

Essential df Command in linux Options

Key options transform df into a production monitoring tool.

-h or --human-readable:

• Reports sizes using G/M/TB
• Instead of bytes

-T or --print-type:

• Prints filesystem type
• Example: ext4, xfs, nfs

-i or --inodes:

• Shows inode utilization %
• Critical for "No space left on device"
• When free blocks exist

---

Customize output options:

--output=columns: Specify output columns.

-x or --exclude: Skip filesystems.

• Example: --exclude=tmpfs skips ramdisks

--total: Adds grand total line.

-t or --type: Limit by type.

• Example: -t ext4 shows only ext4 partitions

Sysadmin quick overview:

df -hT --total gives complete disk report instantly.

Option	Purpose	Example
-h	Human readable	df -h
-T	Show filesystem type	df -hT
-i	Inode usage	df -i

df Command Examples for Beginners

Disk capacity methods:

df -h: Human-readable for all filesystems.

watch -n 5 df -h: Refreshes every 5 seconds.

>90% usage alert:

df -h | awk '$5 ~ /9[0-9]/{print}'

WordPress root partition:

df -h /var/www

---

Capacity check only:

df -h --output=source,target,pcent | grep -v tmpfs

• Excludes ramdisk displays

Multiple servers:

df -h --total | tail -1

• Aggregate usage total

Indian hosting monitoring:

df -h /home /var/www /var/log /tmp

• Customer websites
• WordPress
• Logs
• Tmp files

CLI monitoring = 90% sysadmin needs.

Advanced df Command Techniques

Custom Output:

df --output=source,fstype,size,used,avail,pcent,target --noheader

• Creates aligned column tables

Limit output:

df -t nfs: NFS file systems only

df -x loop: Excludes loop devices

Inode crisis detection:

df -i / | awk '$5 > 90{print}'

---

Portable monitoring:

df -h --local

• Hard drives only
• Ignores Windows/networked filesystems

Filesystem health check:

df -hT | grep -E "(ext4|xfs)"

• Data partitions only

Alert threshold (85%+):

df -h | awk 'NR>1 && $5+0 > 85{print $0 " ALERT!"}'

Production-level monitoring insights follow.

df vs du: Critical Differences Explained

df = filesystem totals (instant), du = directory totals (slow recursive). df shows 100% used when processes hold deleted files open. du misses these “ghost” files. Solution: lsof | grep deleted + service restart.

Metric	df	du
Scope	Filesystem	Directory
Speed	Instant	Minutes
Use Case	Alerts	Cleanup

Workflow: df -h → alert → du -sh /* → cleanup.

Real-World Sysadmin Use Cases

Web servers:

df -h /var/www /tmp /var/log

• Check space usage

FIFO databases:

df -h /var/lib/mysql with watch command.

Email servers:

df -h /var/spool or df -h /home.

Backups:

df -h /backup or df -h /mnt/usb.

---

Indian hosting disk alert:

df -h --output=pcent,target | awk '$1>85{print $2 "CRITICAL: " $1}' | mail -s "Disk Alert" ad***@**st.com

Pre-upgrade check:

df -h --min-cols | grep -v "100%"

Nagios-style check:

df -l | tail -1 | awk '{print $5}' | sed 's/%//'

These cover 95% production monitoring.

df in Scripting and Automation

#!/bin/bash
REPORT="/var/log/df-report-$(date +%Y%m%d).txt"
echo "Disk Space Report: $(date)" > $REPORT
df -hT --output=source,fstype,size,used,avail,pcent,target >> $REPORT
CRITICAL=$(df -h --output=pcent,target | awk 'NR>1 && $1+0>90{print $2}')
if [ ! -z "$CRITICAL" ]; then
  echo "CRITICAL: $CRITICAL" | mail -s "URGENT Disk Full" op*@*****ny.com
fi
echo "Top 5 fullest:" >> $REPORT
df -h --output=pcent,target | sort -hr | head -6 >> $REPORT

Cron: */5 * * * * /usr/local/bin/df-monitor.sh

Performance Tips for df Monitoring

df executes instantly regardless of filesystem size. Optimize parsing: df -h --noheader --output=pcent,target | while read pct mount; do [ ${pct%\%} -gt 85 ] && echo "ALERT $mount"; done. Cache results: df -h > /var/run/df.cache; watch -n 30 'tail -10 /var/run/df.cache'.

Zabbix/Nagios: df --output=pcent,$MOUNTPOINT | tail -1. Multi-server: for host in server1 server2; do ssh $host "df -h --total / | tail -1"; done. Avoid df -a (includes empty mounts). Use --local for production servers excluding NFS.

Common Errors and Troubleshooting while using df command in linux

100% used but du shows space: Deleted open files: lsof | grep deleted → restart service. Inodes full: df -i → find small file floods. NFS stale: df -t nfs → umount -f. “No such file”: Use mountpoint paths.

Script fix: df -h --output=source,pcent,target 2>/dev/null | awk 'NR>1 && $2+0>95{print "CRITICAL: " $3 " (" $2 ")"}'. Common after log rotation failures, mysqldump hangs, WordPress upload limits. Always check inodes + blocks.

Best Practices for Disk Monitoring

• Alert at 80%, critical 90%.
• Monitor inodes + blocks.
• Exclude tmpfs/devtmpfs.
• Baseline per filesystem type.
• 5-minute cron intervals.
• Email + Slack + PagerDuty.
• Capacity planning (never <20% free).

WordPress: /var/www, /tmp, /var/log.

Database: /var/lib/mysql.

Enterprise: Integrate Prometheus Node Exporter.

Indian SMBs: Focus /home quotas.

Document thresholds per server role (web/mail/db/backup).

df Command in Cybersecurity

Ransomware fills /tmp: watch -n 10 'df -h /tmp /var/tmp | tail -1'. Crypto-miners target /dev/shm: df -x tmpfs | grep shm. DDoS log floods: df -h /var/log | awk '$5>80'.

#!/bin/bash
for fs in /tmp /var/tmp /dev/shm /var/log; do
  PCT=$(df -h --output=pcent $fs | tail -1 | tr -d '% ')
  if [ $PCT -gt 85 ]; then
    echo "SECURITY ALERT: $fs at ${PCT}%" | mail -s "Potential Attack" so*@*****ny.com
  fi
done

20 Detailed FAQs on df Command in linux

1. What does “df” stand for? Disk Free. Shows filesystem totals instantly across all mounts.
2. Human-readable output? df -h. Converts bytes to K/M/G/TB + percentages.
3. df shows 100% but space exists? Deleted-but-open files. lsof | grep deleted + restart service.
4. Check specific partition only? df -h /var or df -h /dev/sda1.
5. Show filesystem types? df -hT. Identifies ext4/xfs/nfs for troubleshooting.
6. Monitor inode usage? df -i. Finds “No space left” with free blocks.
7. Alert on 90%+ usage? df -h | awk '$5 ~ /[9][0-9]/{print}'.
8. Exclude tmpfs/ramdisks? df -x tmpfs or df --local.
9. Custom columns only? df --output=source,pcent,target.
10. Show grand total? df -h --total. Aggregate across all filesystems.
11. NFS mounts only? df -t nfs. Network storage monitoring.
12. Refresh every 10 seconds? watch -n 10 df -h.
13. JSON output for monitoring? df --output=json (newer versions).
14. Find fullest filesystem? df -h --output=pcent | sort -hr | head -2.
15. Local disks only? df -l excludes network mounts.
16. Script exit code on threshold? df -h | awk '$5+0>90{exit 2}'.
17. WordPress monitoring? df -h /var/www /tmp /var/log.
18. Database partition check? df -h /var/lib/mysql /var/lib/pgsql.
19. Cron monitoring example? 5-minute disk alerts with email.
20. Best GUI replacement? baobab or server monitoring dashboards.