df, du and free explainer

Paste df, du or free output to see which disk is full, what takes the space and whether memory is really low.

Last updated

In short: df -h shows how full each disk is (Use% is the number to watch; above 90 % is getting critical), du -sh * shows how much space each folder here takes, and free -h shows memory, where the 'available' column is what matters and buff/cache is not wasted. Paste any of the three and this page says in plain words what it means, skipping the virtual filesystems and loop devices that confuse most people. Nothing you paste leaves your browser.

Your input never leaves your browser. Everything is calculated on your device; nothing you type is sent to a server.

Paste the full output, including the header line.

Examples:

Review generated files before you use them. Provided as-is — see Terms.

How does the df, du and free explainer work?

Three small commands answer most "is my server full?" questions. df -h (disk free) lists every mounted filesystem with its size, used and available space, and Use%. du -sh * (disk usage) adds up the files in each folder where you are, so you can find what takes the space. free -h shows memory (RAM) and swap. The -h means human-readable: sizes like 4.0K, 12M and 1.5G, counted in powers of 1024.

df output is noisy. Lines for tmpfs, devtmpfs and overlay are virtual filesystems that live in RAM or belong to containers, and /dev/loop lines are snap packages that always show 100 %. The lines that matter are the real partitions, above all /. Above 90 % it is time to clean up: old logs (journalctl --vacuum-size=500M), unused container images (podman image prune) and package caches are the usual suspects. On ext4 about 5 % of each filesystem is reserved for root, which is why Used + Avail is less than Size.

In free output, available is the column that matters. Linux deliberately fills spare RAM with a cache of recently used files (buff/cache), so free is often small on a healthy system; the cache is handed back the moment a program needs memory. Worry when available drops below about 10 % of total, or when swap keeps growing while the system feels slow. The column meanings are documented in the free(1) manual page.

Worked examples

A root filesystem filling up

Input /dev/nvme0n1p2 468G 403G 42G 91% / gives Your root filesystem (/), where the system and programs live, is 91 % full: that is getting critical.

Only 42G is left. At 100 % programs can no longer save files, databases stop and logs get lost, so clean up soon: old logs (journalctl --vacuum-size=500M), unused container images (podman image prune) and package caches are the usual suspects.

Which folder is so big?

Input du -sh * in a project folder: 1.2G node_modules, 156M target, 12M dist gives These 3 use most of the space: node_modules 1.2G (88 %), target 156M (11 %), dist 12M (1 %).

node_modules alone takes more than half. du -sh * skips hidden folders such as .git or .cache, so run du -sh .[!.]* * | sort -h to include them.

Is my RAM really full?

Input Mem: 15Gi total, 5.2Gi used, 1.1Gi free, 9.4Gi buff/cache, 9.8Gi available gives Memory is fine: 9.8Gi (65 %) of 15Gi is available for programs.

'free' looks low because Linux uses spare memory as a disk cache (buff/cache) and gives it back the moment a program needs it. The available column already includes that, so it is the number to watch.

Frequently asked questions

Why does free show so little free memory?

Linux uses RAM that programs do not need as a cache for files on disk, which makes things faster. That cache shows up under buff/cache, not under free, and is handed back instantly when a program needs memory. Look at the available column: that is how much memory new programs can get.

What does Use% in df -h mean?

How full the filesystem is, as Used divided by Used + Avail. Below 80 % is fine, above 90 % needs attention, and at 100 % programs fail to write files. On ext4 about 5 % is reserved for root, so Used + Avail is a bit less than Size.

Why is /dev/loop at 100 %?

Loop devices are disk images mounted as filesystems, usually snap packages on Ubuntu. They are read-only and exactly as big as their contents, so they always show 100 %. You can ignore them in df output (df -x squashfs hides them).

Why do df and du show different numbers?

df asks the filesystem how many blocks are in use; du adds up the files it can see. They differ when a deleted file is still held open by a running program (the space is freed only when it closes; find them with lsof +L1), when du lacks permission to read some folders, or when something is mounted over a folder that has files in it.

Is my output sent anywhere?

No. The text is parsed and explained by JavaScript in your browser; nothing you paste is transmitted.