Linux du Command Examples for Disk Usage Analysis

Disk cleanup gets easier once you can answer two questions quickly: which path is largest, and whether that size belongs to real files, mounted filesystems, cache, logs, or sparse data. These du command examples for Linux disk usage analysis focus on that workflow rather than a long option catalog.

The du command is included on normal Linux installations, so most checks need no extra package. Use the du command in Linux reference for a compact option catalog; practical storage audits depend more on combining a few reliable patterns.

Understand du Disk Usage Analysis

du estimates disk blocks used by files and directories. That is different from df, which reports capacity and free space for mounted filesystems, and different from ls -lh, which shows apparent file length. Sparse files, hard links, deleted-but-open files, reserved filesystem blocks, and mount points can make those numbers disagree.

Verify du Is Available

Confirm that your shell can find du before testing examples:

command -v du

/usr/bin/du

Full coreutils implementations support the option set used in these workflows. Minimal BusyBox systems support common short options such as -s, -h, -d, -c, -a, -x, and -l, but they usually lack GNU-compatible long options such as --time, --exclude, and --apparent-size.

Quick du Command Reference for Disk Checks

Task	Command Pattern	Use When
Summarize one directory	du -sh "$HOME/Downloads"	You need one total, not every nested path.
Compare several directories	du -csh "$HOME/Downloads" "$HOME/Documents"	You need per-directory totals plus a grand total.
Show top-level children	du -h -d 1 /var	You need the largest immediate subdirectories first.
Find largest items	du -ah "$HOME/Downloads" | sort -rh | head -20	You need files and directories ranked by size.
Skip noisy patterns	du -sh --exclude='*.log' /var	You want totals without logs, cache, or generated files.
Stay on one filesystem	sudo du -h -d 1 -x /	You are checking root usage without mounted drives.
Compare apparent size	du --apparent-size -sh disk.img	You are checking sparse files, VM images, or database dumps.

Quick du Examples for Directory Size Checks

The fastest du checks combine -s for a summary and -h for human-readable units. Use these when you need a folder-size answer before archiving, moving, or deleting anything.

Check the Current Directory Size

du -sh .

2.4G    .

The dot means the current working directory. du -sh . counts hidden files and hidden directories under that path because du walks the directory tree itself.

Check a Specific Directory Size

Pass a path when the directory is somewhere else:

du -sh "$HOME/Downloads"

4.8G    /home/alex/Downloads

Quote paths that may contain spaces. A path such as $HOME/Project Files needs quotes so the shell passes it to du as one argument.

Compare Multiple Directory Totals

Add -c when several paths need a combined total:

du -csh "$HOME/Downloads" "$HOME/Documents" "$HOME/Videos"

4.8G    /home/alex/Downloads
812M    /home/alex/Documents
19G     /home/alex/Videos
25G     total

The final total line is useful before copying several directories to another disk, backup target, or archive.

Show du Output in MiB or GiB

Human-readable sizes are easiest to scan, but fixed units work better in spreadsheets or monitoring notes. Use -m for MiB-sized blocks, or use --block-size=1G on full coreutils systems when each line should be scaled to GiB-sized blocks:

du -sm "$HOME/Downloads"
du -s --block-size=1G "$HOME/Downloads"

4916    /home/alex/Downloads
5       /home/alex/Downloads

The second value is rounded in 1G block units, so a 4.8G directory appears as 5. Keep -sh when readable units matter more than fixed report units.

Find Large Files and Folders with du

When a filesystem is almost full, a plain summary is not enough. Limit the depth first, then sort the results so the largest paths rise to the top.

Rank Top-Level Directories by Size

Depth 1 shows the target directory plus its immediate children:

du -h -d 1 /var | sort -rh

5.6G    /var
3.9G    /var/lib
1.2G    /var/log
312M    /var/cache
16K     /var/tmp

sort -rh sorts human-readable sizes in reverse order. Without -h, values such as 900M and 1.2G can sort incorrectly as plain text.

Prefer this depth-limited pattern over du -sh * | sort -rh when hidden entries should be included. The shell expands * before du runs, and normal globs skip dotfiles.

List the Largest Files and Directories

Add -a when individual files matter, then keep the first 20 results:

du -ah "$HOME/Downloads" | sort -rh | head -20

4.8G    /home/alex/Downloads
2.1G    /home/alex/Downloads/linux.iso
940M    /home/alex/Downloads/videos
612M    /home/alex/Downloads/videos/demo.mp4
184M    /home/alex/Downloads/archive.tar.zst

This is the most direct du pattern for finding large files in a directory. For very large trees, start with -d 1 first, then drill into the largest child path.

Measure Root Usage Without Crossing Filesystems

sudo du can read directories your normal user cannot access. Keep -x when scanning from / so removable drives, network mounts, and virtual filesystems do not distort the root filesystem total.

sudo du -h -d 1 -x / 2>/dev/null | sort -rh | head -20

31G     /
15G     /usr
8.4G    /var
5.1G    /home
1.8G    /opt

The 2>/dev/null redirect hides permission warnings from paths that are not relevant to the ranked output. Remove it when you are troubleshooting access problems and need to see every error.

Filter du Output for Cleaner Disk Reports

Large application trees often contain logs, caches, build artifacts, or backups that can hide the path you actually care about. Filter those patterns only when they are noise for the current question.

Exclude File Patterns from du Totals

Use --exclude with a quoted shell pattern:

du -sh --exclude='*.log' "$HOME/projects/app"

428M    /home/alex/projects/app

The quotes matter because they stop the shell from expanding *.log before du sees the pattern. Add more --exclude options when several file types should be ignored.

du -sh --exclude='*.log' --exclude='*.tmp' --exclude='*.cache' "$HOME/projects/app"

Show Only Entries Above a Size Threshold

The -t threshold option keeps reports focused on paths above a useful size:

du -h -t 500M -d 2 "$HOME" | sort -rh

27G     /home/alex
19G     /home/alex/Videos
4.8G    /home/alex/Downloads
2.4G    /home/alex/projects

A negative threshold reverses the filter. For example, -t -1M shows entries smaller than 1 MiB on implementations that support the threshold option.

Filter du Text Output with grep

When the output is still noisy, filter command output with grep to keep only lines that match a size unit or path pattern:

du -h -d 2 "$HOME" | grep -E '^[[:space:]]*[0-9.]+G'

19G     /home/alex/Videos
4.8G    /home/alex/Downloads
2.4G    /home/alex/projects

Compare du Disk Usage, Apparent Size, and Links

Some storage investigations need more than a basic directory total. These examples explain why du can show a smaller or larger number than another command.

Compare Disk Usage with Apparent Size

Sparse files can reserve a large apparent length while using little actual disk space. Check both views before judging VM images, database dumps, and preallocated files:

du -sh "$HOME/snapshots/vm-disk.img"

64M     /home/alex/snapshots/vm-disk.img

du --apparent-size -sh "$HOME/snapshots/vm-disk.img"

20G     /home/alex/snapshots/vm-disk.img

The first command reports allocated disk blocks. The second reports the file length an application sees.

Follow Symbolic Links When Needed

By default, du measures the symlink entry itself, not the linked target. Add -L when the target’s contents should count:

du -shL "$HOME/current-release"

1.7G    /home/alex/current-release

Use -L deliberately. Following symlinks can pull in data outside the directory tree you meant to inspect.

Count Hard-Linked Files Separately

du normally counts hard-linked data once, even if several directory entries point to it. Add -l when backup sets or deduplicated trees need each link counted in its own directory total:

du -slh "$HOME/backups/daily"

72G     /home/alex/backups/daily

The lowercase -l flag is easy to confuse with the uppercase -L symlink flag. Check the command carefully before using it in reports.

Show Modification Times Beside Sizes

The --time option adds the newest modification time seen under each directory:

du -ah --time "$HOME/Downloads" | sort -rh | head -10

4.8G    2026-05-09 11:43    /home/alex/Downloads
2.1G    2026-05-09 11:40    /home/alex/Downloads/linux.iso
940M    2026-05-08 17:20    /home/alex/Downloads/videos

This helps separate an old archive from a path that is still growing. On BusyBox systems, use find or stat for timestamps because BusyBox du does not provide --time.

Troubleshoot Common du Errors

Most du problems come from permissions, missing paths, variant-specific options, or scanning too much of the filesystem at once.

Permission Denied While Scanning

A protected directory can produce this error:

du: cannot read directory '/var/log/private': Permission denied

Use sudo only when you need a system-wide total or a protected directory is part of the investigation:

sudo du -sh /var/log/private

216M    /var/log/private

If the protected path is irrelevant, redirect errors after confirming you are not hiding the directory that matters:

du -sh /var/log 2>/dev/null

No Such File or Directory

A missing or split path usually looks like this:

du: cannot access '/home/alex/Project Files': No such file or directory

Check the directory name, then quote paths that contain spaces:

ls -ld "$HOME/Project Files"
du -sh "$HOME/Project Files"

drwxr-xr-x 5 alex alex 4096 May 9 11:43 /home/alex/Project Files
1.3G    /home/alex/Project Files

Unsupported du Option on BusyBox

Minimal systems can reject long options that work on full coreutils systems:

du: unrecognized option '--time'

Check the local option set:

du --help

BusyBox output starts with a shorter option list:

Usage: du [-aHLdclsxhmk] [FILE]...

Use short portable options such as -s, -h, -d, -c, -a, and -x on BusyBox. Move GNU-compatible features such as --exclude, --time, and --apparent-size to a full coreutils environment when those reports matter.

du and df Report Different Sizes

df reports filesystem-level usage, while du walks visible files and directories. Differences are normal when files were deleted while still open, another filesystem is mounted inside the path, reserved blocks exist, or sparse files are involved.

df -h /
sudo du -h -d 1 -x / 2>/dev/null | sort -rh | head -20

Relevant output may show the filesystem still nearly full even after du narrows the visible directory totals:

Filesystem       Size  Used Avail Use% Mounted on
/dev/nvme0n1p2    80G   72G  4.1G  95% /
31G     /
15G     /usr
8.4G    /var

If df still shows high usage after large files were removed, restart the service that had the deleted file open or reboot during a maintenance window. Then run the same df and du checks again.

du Takes Too Long on Large Trees

Start broad, then drill down. A shallow root scan is faster and safer than asking du to print every file first:

sudo du -h -d 1 -x / 2>/dev/null | sort -rh | head -20

Move into the largest directory from that output and repeat the same pattern with a narrower path.

Conclusion

du is ready for practical disk usage analysis, from quick folder totals to ranked cleanup targets and filesystem-scoped root scans. Keep -sh for fast checks, -d 1 | sort -rh for triage, and filters such as --exclude or -t when cache, logs, or small files hide the path that matters.