How to Use the du Command to Track Directory Sizes and Disk Usage in Linux

When server alerts fire warning that storage volumes have reached critical capacity, system administrators must act quickly to locate and remediate what is consuming disk space. While the companion command df provides a high-level summary of filesystem partitions, it cannot inspect which individual user directories, forgotten log archives, or bloated container volumes are the culprits. The du (Disk Usage) command is the fundamental Unix utility for measuring recursive file space usage. By traversing directory trees and calculating allocated filesystem blocks, du enables you to isolate rogue storage hogs in seconds directly from the Linux terminal.

Understanding How the du Command Works

Unlike simple file size listings in ls that reflect file character lengths, du measures the actual physical blocks allocated on the storage device by files and subdirectories. This distinction is critical because sparse files, directory structures, and block size alignment (typically 4 KB sectors) cause physical disk consumption to differ from raw byte sizes.

When invoked without arguments, du recursively traverses the current working directory, printing the block size of every single folder—an output that can easily flood your screen across deep directory trees.

Essential Flags for Human-Readable Formatting

To make du output clear and actionable, combine these core flags:

• -h: Human-readable output. Converts raw sector counts into intuitive Kilobytes (K), Megabytes (M), and Gigabytes (G).
• -s: Summary mode. Suppresses individual subdirectory listings and outputs only the grand total for the specified target path.
• -c: Grand total. Appends a final summary row calculating the combined storage of all evaluated arguments.

To inspect the total disk consumption of an entire user directory in a single line:

du -sh /var/log

Controlling Directory Traversal Depth (–max-depth)

To see which top-level folders are consuming space without being overwhelmed by thousands of nested subfolders, restrict output depth with --max-depth:

sudo du -h --max-depth=1 /var

Linux scans the entire /var hierarchy, but reports summarized figures strictly for immediate children (such as /var/log, /var/lib, /var/cache), making storage anomalies instantly obvious.

Sorting Directories by Disk Usage (du with sort)

To find the absolute largest directories on a volume, pipe du directly into sort with human-readable numerical flags:

sudo du -h --max-depth=1 / | sort -hr | head -n 10

Deconstructing this standard sysadmin diagnostic pipeline:

• du -h --max-depth=1 /: Calculates sizes for all root directories.
• sort -hr: Sorts values numerically according to human suffixes (e.g., Gigabytes before Megabytes) in descending reverse order.
• head -n 10: Isolates and prints only the top ten largest consumers.

Excluding Filesystem Boundaries and File Types

When auditing local root partitions, you must prevent du from traversing into mounted network shares (NFS), external USB drives, or virtual in-memory pseudo-filesystems (/proc, /sys):

Use the -x (one-file-system) flag to restrict calculations strictly to the local physical filesystem:

sudo du -shx /

To exclude specific file extensions (such as ignoring video archives or compressed backups during an audit):

du -h --exclude="*.tar.gz" --max-depth=1 ~/projects

Essential du Command Options Reference

Option	Syntax Example	Functionality
-h	du -h /path	Displays sizes in human-readable units (K, M, G)
-s	du -sh /path	Displays single summarized total for the target
--max-depth=N	du -h --max-depth=1	Limits recursion reporting to N directory levels
-a	du -ah /path	Includes individual files in output, not just directories
-c	du -ch folder1 folder2	Appends grand total line at the bottom of output
-x	du -xh /	Stays on local filesystem; skips external mounts
--time	du -h --time /var/log	Displays timestamp of most recent file modification

Frequently Asked Questions

Why does du report a different size than df on the same partition?

df inspects the filesystem superblock directly, while du walks directory trees. If a background process (like Nginx) keeps a deleted log file open in memory, df counts the space as occupied, but du cannot find the unlinked file in the directory tree. Restarting the daemon releases the phantom space.

Why do I get “Permission denied” errors when running du?

Protected system directories (such as /root or /var/spool) are restricted from standard user accounts. Always prepend sudo when performing whole-system disk storage audits.

Can du display sizes in apparent bytes rather than disk allocation?

Yes. Pass the --apparent-size flag. This instructs du to calculate the actual content byte size rather than the physical disk blocks consumed on the drive.