CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / Disk & Storage / df

df

Report used and free space per filesystem

Beginneressentialdisktroubleshooting

df shows every mounted filesystem with its size, used and available space, and where it is mounted. It is the first command after a 'disk full' alert, and with -i it shows the other way a disk fills up: running out of inodes.

Syntaxdf [OPTION]... [FILE]...

Watch it run

A 'disk usage above 90%' alert just fired for devops-lab and you need to know which filesystem it is.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
df -h

One line per mounted filesystem. The root filesystem is at 95% with 1.6G left, so that's what fired the alert. The tmpfs lines live in RAM and can be ignored for a disk alert.

Anatomy of a command

$
commanddf

Disk free: asks the kernel for each filesystem's block and inode counters.

How it works

df never looks at your files. It reads the mount list from /proc/self/mountinfo and calls statfs() on each mount point (or on the FILE you name). The kernel answers from the filesystem's superblock counters: total blocks, free blocks, blocks available to normal users, total and free inodes. Size is total blocks, Used is total minus free, Avail is what a non-root user can still write. On ext4, 5% is reserved for root by default, so Used + Avail is less than Size, and Use% is Used / (Used + Avail), rounded up. Because it only reads counters, df is instant, and it still counts space held by deleted files that a process keeps open, which du cannot see. -i reads the inode counters instead. A dead NFS server can make statfs block, so df hangs; df -l skips network filesystems.

df reads the filesystem's own counters; du adds up the files it can reach by name. A deleted file that is still open is counted by one and not the other.

df -hdu -shx /statfsgetdents + statread counterswalk namesYoudf -h / du -shxdfstatfs per mountduwalks the treeKernel VFSext4 driverSuperblockfree-block countDirectory treenames -> inodesapp.logdeleted, 11Gjava PID 2841fd 5 still open
1/6
df asks for counters

df calls statfs() on each mount point. It never opens a single file.

← → to step

Options you'll actually use

-hHuman-readable sizes, powers of 1024 (1.6G, 881M)
-HHuman-readable, powers of 1000 (matches what cloud consoles and vendors print)
-TShow the filesystem type column
-iInode usage instead of blocks: Inodes, IUsed, IFree, IUse%
-x TYPEExclude a filesystem type (repeatable): -x tmpfs -x squashfs
-t TYPEOnly show filesystems of this type: -t ext4 -t xfs
-lLocal filesystems only; avoids hanging on a dead NFS mount
--output=FIELDSPick columns: source,fstype,size,used,avail,pcent,ipcent,target
--totalAdd a grand-total line
-PPOSIX format: one line per filesystem, safe to parse with awk
-aInclude pseudo, duplicate and inaccessible filesystems (proc, sysfs...)

Common mistakes

rm /var/log/app/app.log to free space while the app is running

The process keeps the file open, so the blocks stay allocated and df doesn't change. The name is gone, which makes it harder to find.

sudo truncate -s 0 /var/log/app/app.log (or restart the service after rm)
Seeing 'No space left on device', checking df -h and concluding the disk is fine

ENOSPC also happens when the filesystem has no free inodes left. df -h only shows blocks.

df -i /data
Adding Used and Avail and expecting Size

ext4 reserves 5% of blocks for root by default. Avail is what normal users can still write, so Used + Avail is smaller than Size.

sudo tune2fs -l /dev/nvme1n1 | grep 'Reserved block count'
Running df in a monitoring script on a box with NFS mounts

If the NFS server is unreachable, statfs blocks and df hangs, piling up stuck checks.

df -l (local only) or timeout 5 df -P /

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show all filesystems with human-readable sizes and their types, without the tmpfs ones.

  2. 2

    Which filesystem holds /var/log/app, and how full is it?

  3. 3

    Check inode usage of the root filesystem.

  4. 4

    Print only the usage percentage of / as a bare number, for a script.

Related commands

duFind out which files and directories use the spacelsblkList disks, partitions and where they are mountedmountAttach a filesystem to the directory treelsofList open files, sockets and the processes holding them
PreviousnohupNextdu
Linux / Disk & Storage / df

df

Report used and free space per filesystem

Beginneressentialdisktroubleshooting

df shows every mounted filesystem with its size, used and available space, and where it is mounted. It is the first command after a 'disk full' alert, and with -i it shows the other way a disk fills up: running out of inodes.

Syntaxdf [OPTION]... [FILE]...

Watch it run

A 'disk usage above 90%' alert just fired for devops-lab and you need to know which filesystem it is.

devops@devops-lab: ~ — zsh — 96×28
➜ ~
Step 1 of 2
df -h

One line per mounted filesystem. The root filesystem is at 95% with 1.6G left, so that's what fired the alert. The tmpfs lines live in RAM and can be ignored for a disk alert.

Anatomy of a command

$
commanddf

Disk free: asks the kernel for each filesystem's block and inode counters.

How it works

df never looks at your files. It reads the mount list from /proc/self/mountinfo and calls statfs() on each mount point (or on the FILE you name). The kernel answers from the filesystem's superblock counters: total blocks, free blocks, blocks available to normal users, total and free inodes. Size is total blocks, Used is total minus free, Avail is what a non-root user can still write. On ext4, 5% is reserved for root by default, so Used + Avail is less than Size, and Use% is Used / (Used + Avail), rounded up. Because it only reads counters, df is instant, and it still counts space held by deleted files that a process keeps open, which du cannot see. -i reads the inode counters instead. A dead NFS server can make statfs block, so df hangs; df -l skips network filesystems.

df reads the filesystem's own counters; du adds up the files it can reach by name. A deleted file that is still open is counted by one and not the other.

df -hdu -shx /statfsgetdents + statread counterswalk namesYoudf -h / du -shxdfstatfs per mountduwalks the treeKernel VFSext4 driverSuperblockfree-block countDirectory treenames -> inodesapp.logdeleted, 11Gjava PID 2841fd 5 still open
1/6
df asks for counters

df calls statfs() on each mount point. It never opens a single file.

← → to step

Options you'll actually use

-hHuman-readable sizes, powers of 1024 (1.6G, 881M)
-HHuman-readable, powers of 1000 (matches what cloud consoles and vendors print)
-TShow the filesystem type column
-iInode usage instead of blocks: Inodes, IUsed, IFree, IUse%
-x TYPEExclude a filesystem type (repeatable): -x tmpfs -x squashfs
-t TYPEOnly show filesystems of this type: -t ext4 -t xfs
-lLocal filesystems only; avoids hanging on a dead NFS mount
--output=FIELDSPick columns: source,fstype,size,used,avail,pcent,ipcent,target
--totalAdd a grand-total line
-PPOSIX format: one line per filesystem, safe to parse with awk
-aInclude pseudo, duplicate and inaccessible filesystems (proc, sysfs...)

Common mistakes

rm /var/log/app/app.log to free space while the app is running

The process keeps the file open, so the blocks stay allocated and df doesn't change. The name is gone, which makes it harder to find.

sudo truncate -s 0 /var/log/app/app.log (or restart the service after rm)
Seeing 'No space left on device', checking df -h and concluding the disk is fine

ENOSPC also happens when the filesystem has no free inodes left. df -h only shows blocks.

df -i /data
Adding Used and Avail and expecting Size

ext4 reserves 5% of blocks for root by default. Avail is what normal users can still write, so Used + Avail is smaller than Size.

sudo tune2fs -l /dev/nvme1n1 | grep 'Reserved block count'
Running df in a monitoring script on a box with NFS mounts

If the NFS server is unreachable, statfs blocks and df hangs, piling up stuck checks.

df -l (local only) or timeout 5 df -P /

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show all filesystems with human-readable sizes and their types, without the tmpfs ones.

  2. 2

    Which filesystem holds /var/log/app, and how full is it?

  3. 3

    Check inode usage of the root filesystem.

  4. 4

    Print only the usage percentage of / as a bare number, for a script.

Related commands

duFind out which files and directories use the spacelsblkList disks, partitions and where they are mountedmountAttach a filesystem to the directory treelsofList open files, sockets and the processes holding them
PreviousnohupNextdu