du Command in Linux (With Examples)

The du (disk usage) command estimates file and directory space consumption directly from the terminal. System administrators use du to locate oversized directories, audit log growth, and plan storage capacity. Whether you need to find what is eating disk space on a production server or simply check a project folder’s size, du provides the answers without installing additional tools. By the end of this guide, you will be able to summarize directory sizes, sort output to find the largest consumers, exclude unwanted files, and combine du with other commands for powerful disk analysis workflows.

Understand the du Command Syntax and Options

Basic du Syntax

The du command follows a straightforward pattern:

du [OPTIONS] [FILE_OR_DIRECTORY...]

When run without arguments, du recursively walks the current directory and prints the disk usage of every subdirectory in 1024-byte (1 K) blocks. Adding options changes the output unit, depth, or format. You can pass one or more paths to check specific locations instead of the current directory.

Verify du Is Available

The du command ships as part of GNU coreutils, which is pre-installed on virtually every Linux distribution. Confirm it is available by checking its version:

du --version

du (GNU coreutils) 9.4
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.

If you are on a minimal container such as Alpine Linux (BusyBox), the --version flag is not supported. Run du --help instead to confirm availability. BusyBox du supports the most common flags (-s, -h, -d, -c, -a) but lacks --time, --apparent-size, and --exclude.

Essential du Options Quick Reference

Option	Description	Example
-h	Human-readable sizes (K, M, G)	du -h /var/log
-s	Show only the total for each argument	du -sh ~/Documents
-c	Print a grand total at the end	du -ch /var/log /tmp
-a	Include individual files, not just directories	du -ah ~/projects
-d N	Limit output to depth N	du -hd1 /
-k	Display sizes in kilobytes	du -sk /tmp
-m	Display sizes in megabytes	du -sm /home
--time	Show last modification timestamp	du -h --time /var/log
--exclude	Skip files matching a pattern	du -sh --exclude='*.log' /var
-t SIZE	Exclude entries below (or above, if negative) a threshold	du -h -t 100M /home
--apparent-size	Print file sizes rather than disk allocation	du --apparent-size -sh ~/data
-L	Follow symbolic links	du -shL /opt/app
-x	Stay on one filesystem (skip mount points)	du -shx /

Display du Disk Usage Summaries

The most common du use case is checking how much space a directory consumes. The -s (summarize) flag collapses the output to a single total, and -h (human-readable) converts raw block counts to K/M/G units.

Summarize the Current Directory

du -sh

2.2M    .

The output shows the total size of the current working directory in human-readable format. Without -h, the number would appear as raw 1 K blocks.

Check a Specific Directory

Pass a path to check a directory other than the current one:

du -sh /var/log

148M    /var/log

This is useful for quickly auditing well-known directories such as /var/log, /tmp, or /home without navigating into them first.

Summarize Multiple Directories at Once

You can pass several paths in a single command. Add -c to include a grand total at the end:

du -csh /var/log /tmp /home

148M    /var/log
12K     /tmp
3.1G    /home
3.2G    total

The -c flag adds the “total” line, which is helpful when comparing several locations in a single glance.

Control du Output Units

By default, du reports sizes in 1024-byte blocks. You can force specific units with dedicated flags or the flexible -B (block-size) option.

Fixed Unit Flags

Use -k for kilobytes or -m for megabytes when you need consistent units for scripting or reports:

du -sk /var/log

151552  /var/log

du -sm /var/log

148     /var/log

These flags output plain numbers without unit suffixes, which makes the output easier to parse in scripts with tools like awk or cut.

Custom Block Size with -B

The -B flag scales output to any block size. Common suffixes are K (1024), M (1048576), and G (1073741824):

du -sB G /home

4       /home

The number shown is rounded up to the nearest whole block. For decimal output, prefer -h instead.

Limit du Directory Depth

Running du on a large directory tree can produce thousands of lines. The -d (or --max-depth) option restricts how many levels deep the output goes.

Show Top-Level Subdirectory Sizes

Set depth to 1 to see immediate children only:

du -hd1 /var

4.0K    /var/opt
148M    /var/log
56M     /var/cache
12K     /var/tmp
8.0K    /var/mail
204M    /var

This immediately reveals which subdirectory is consuming the most space without listing every nested file.

Use Depth 0 as a Summary Alternative

Setting -d0 is equivalent to -s. Both produce a single total for the target path:

du -hd0 /var

204M    /var

Display Modification Timestamps with du

The --time flag adds a modification timestamp column to the output, which helps identify which directories or files were recently changed.

Show Timestamps for Subdirectories

du -h --time /var/log

4.0K    2026-01-15 08:30    /var/log/apt
32M     2026-02-10 11:00    /var/log/journal
12K     2026-02-09 23:45    /var/log/nginx
148M    2026-02-10 11:21    /var/log

The timestamp reflects the most recent modification of any file within that directory.

Show Timestamps for Individual Files

Combine --time with -a (all files) to see per-file timestamps:

du -ah --time ~/Documents/*.pdf

2.4M    2025-11-20 14:33    /home/user/Documents/report.pdf
512K    2026-01-05 09:12    /home/user/Documents/invoice.pdf

The --time flag is a GNU extension. BusyBox (Alpine Linux) and BSD (macOS) versions of du do not support it. On macOS, use stat -f "%z %Sm %N" * as an alternative.

Exclude Files and Directories with du

The --exclude flag filters files matching a shell glob pattern from the output. This is useful when you want disk usage without counting temporary files, logs, or caches.

Exclude by File Extension

To check a directory’s size while ignoring .log files, quote the pattern to prevent the shell from expanding the glob:

du -sh --exclude='*.log' /var

56M     /var

Always wrap --exclude patterns in single quotes. Without quoting, the shell may expand *.log to matching filenames in the current directory before du sees the pattern, causing unexpected results.

Exclude Multiple Patterns

Repeat --exclude for each pattern you want to skip:

du -sh --exclude='*.log' --exclude='*.tmp' --exclude='*.cache' /var

For a long list of patterns, store them in a file and pass it with --exclude-from:

cat ~/du-excludes.txt

*.log
*.tmp
*.cache
*.bak

du -sh --exclude-from=~/du-excludes.txt /var

Filter by Size Threshold

The -t (threshold) option excludes entries below a given size. Use this to focus on only the large consumers:

du -h -t 100M --max-depth=1 /home

1.2G    /home/user/Videos
450M    /home/user/.local
3.1G    /home/user
3.1G    /home

Only directories consuming 100 MB or more appear in the output. A negative threshold (e.g., -t -50M) shows entries smaller than the value instead.

Combine du with Other Commands

Piping du output into other utilities unlocks sorting, filtering, and formatting capabilities that du alone does not provide.

Sort Directories by Size

Pipe the output of du into sort -rh to rank directories from largest to smallest:

du -hd1 /var | sort -rh

204M    /var
148M    /var/log
56M     /var/cache
12K     /var/tmp
8.0K    /var/mail
4.0K    /var/opt

The -r flag reverses the order (largest first) and -h tells sort to interpret human-readable suffixes (K, M, G) correctly.

Find the Largest Files in a Directory

Combine -a (all files) with sort and head to display only the top consumers:

du -ah /var/log | sort -rh | head -10

148M    /var/log
32M     /var/log/journal
28M     /var/log/journal/abc123
16M     /var/log/syslog.1
12M     /var/log/kern.log
8.5M    /var/log/auth.log
4.2M    /var/log/dpkg.log
2.1M    /var/log/apt/term.log
1.4M    /var/log/nginx/access.log
800K    /var/log/nginx/error.log

This pipeline is one of the fastest ways to pinpoint exactly where disk space is going.

Filter du Output with grep

Use grep to isolate specific subdirectories from verbose output:

du -h --max-depth=2 /home | grep -E '^\s*[0-9.]+G'

This filters the output to show only entries measured in gigabytes, helping you quickly spot heavy subdirectories within /home.

Advanced du Techniques

Apparent Size vs Disk Usage

By default, du reports disk usage (how many blocks the filesystem allocates), which can differ from the actual byte count of a file. The --apparent-size flag shows the file’s logical size instead:

du -sh ~/database.sql

52M     /home/user/database.sql

du --apparent-size -sh ~/database.sql

50M     /home/user/database.sql

The difference occurs because filesystems allocate space in fixed-size blocks. A 50 MB file on a filesystem with 4 K blocks may occupy 52 MB of actual disk allocation. Sparse files can show the opposite: apparent size larger than disk usage.

Handle Symbolic Links

By default, du does not follow symbolic links (-P behavior). To follow them and count the target’s size instead, use -L:

du -shL /opt/app

Be cautious with -L on directories that contain circular symlinks, as du may loop or double-count space.

Stay on One Filesystem

When scanning from the root directory, du crosses into every mounted filesystem (NFS shares, USB drives, /proc, /sys) by default. The -x flag restricts du to the same filesystem as the starting path:

sudo du -shx /

This gives the true disk consumption of the root filesystem without including mounted volumes. The sudo prefix is needed to read directories owned by other users, such as /root and service accounts.

Count Hard Links Separately

The -l flag tells du to count hard-linked files each time they appear rather than counting shared blocks only once. This is useful for auditing how much space a directory’s files would consume if copied without preserving hard links:

du -slh /var/backups

Without -l, hard-linked files sharing the same inode contribute their block count only once to the total.

Troubleshoot Common du Errors

“Permission denied” Messages

When du encounters directories your user account cannot read, it prints a warning and skips them:

du: cannot read directory '/root': Permission denied

This commonly happens when scanning system directories like / or /var. To include all directories in the total, run du with elevated privileges:

sudo du -shx /

To suppress the warnings without using sudo, redirect standard error:

du -sh /var 2>/dev/null

“No such file or directory” Errors

If a file or directory is deleted while du is running, or you pass a path that does not exist:

du: cannot access '/tmp/session_abc123': No such file or directory

This is common in directories with rapidly changing contents, like /tmp. The error is informational and does not affect the totals for other files. Redirect stderr if it clutters your output.

du and df Report Different Sizes

A common source of confusion is that du -sh / and df -h / often show different numbers. The reasons include:

• Deleted-but-open files: When a process holds a file descriptor to a deleted file, df still counts the space as used, but du cannot see the file. Restart the process or use lsof +L1 to find these.
• Filesystem metadata: df accounts for space consumed by journal logs, superblocks, and reserved blocks that du does not report.
• Mount points: Without -x, du may follow mount points and count space on other filesystems.
• Sparse files: du reports actual disk allocation, while ls -l shows apparent size. Use du --apparent-size to compare.

To find deleted-but-open files that are holding space, run:

sudo lsof +L1 | head -20

du Takes Too Long on Large Filesystems

Scanning millions of files with du can take minutes. Speed up the process by limiting depth and excluding unnecessary paths:

sudo du -hd1 -x --exclude='proc' --exclude='sys' /

The -x flag prevents crossing into virtual filesystems, and -d1 limits output to the top-level directories. For interactive exploration of large directory trees, consider a tool like ncdu which provides a navigable interface.

Conclusion

The du command provides a reliable way to audit disk consumption from the terminal. Key patterns to remember include du -sh for quick totals, du -hd1 | sort -rh to rank subdirectories by size, and --exclude to filter noise. Combine du with grep, sort, and head for targeted analysis of any directory tree.