Linux Disk and Storage

Why Storage Skills Matter

Disk issues are some of the most common Linux problems. Applications fail when logs fill a partition, backups consume unexpected space, or a new disk is not mounted correctly.

DevOps engineers need to answer questions like:

• how much free space is left?
• which directory is using it?
• what disks are attached?
• is the filesystem mounted where I expect?

Checking Space with df

df reports filesystem-level disk usage.

df
df -h

-h shows human-readable sizes such as G and M.

Example:

df -h /var

This is useful when a specific path is having storage issues.

Measuring Directory Usage with du

du shows how much space directories and files consume.

du -sh /var/log
du -sh *
du -ah /var/log | sort -h

Common flags:

• -s summary only
• -h human-readable
• -a include files

df tells you how full the filesystem is. du helps you find what is taking the space.

Viewing Block Devices with lsblk

lsblk lists block devices such as disks and partitions.

lsblk
lsblk -f

This shows device names, sizes, mount points, and sometimes filesystem types.

It is especially useful after attaching a new cloud volume.

Mounting and Unmounting

Linux makes filesystems available by mounting them into the directory tree.

Mount a device:

sudo mount /dev/xvdf1 /mnt/data

Unmount it:

sudo umount /mnt/data

The command is umount, not unmount.

Note: A filesystem usually cannot be unmounted if processes are actively using it.

Persistent Mounts with /etc/fstab

To mount a filesystem automatically at boot, add it to /etc/fstab.

Example entry:

UUID=1234-ABCD /data ext4 defaults,nofail 0 2

Fields define the device, mount point, filesystem type, options, and fsck order.

A broken /etc/fstab entry can cause boot problems, so edit carefully and test before rebooting.

Creating Archives with tar

tar is the standard archiving tool on Linux.

Create an archive:

tar -cvf backup.tar project/

Extract an archive:

tar -xvf backup.tar

Common flags:

• -c create
• -x extract
• -v verbose
• -f file name

Compressing with gzip and gunzip

gzip compresses files.

gzip app.log
gunzip app.log.gz

It is often combined with tar:

tar -czvf backup.tar.gz project/
tar -xzvf backup.tar.gz

Here -z tells tar to use gzip compression.

Working with zip and unzip

Some teams or tools prefer the ZIP format.

zip -r site.zip site/
unzip site.zip

ZIP is especially common when exchanging files across platforms.

Finding Large Files

When a disk fills up, you often need to find the biggest offenders.

A practical approach:

du -ah /var | sort -h | tail -n 20

Another useful pattern:

find /var -type f -size +100M

This finds files larger than 100 MB.

Real-World Scenario

Suppose alerts say /var is 95% full. You might investigate with:

df -h /var
du -sh /var/log/*
find /var/log -type f -size +100M

If one log file grew unexpectedly, you now know where to focus.

Or imagine attaching a new volume to a cloud VM. You could verify it with:

lsblk
sudo mount /dev/xvdf1 /mnt/data
df -h /mnt/data

That confirms the device exists, is mounted, and has usable space.

Test Your Understanding

Exercise 1: Checking filesystem capacity

Question: Which command from the lesson tells you the free space available on mounted filesystems such as /var?

Exercise 2: Configuring persistent mounts

Question: Which file should you edit to make a filesystem mount persist automatically at boot?

Exercise 3: Building a compressed backup

Question: Which tar command from the lesson creates a gzip-compressed archive of the project directory?

---

Key takeaways

• df -h for filesystems, du -sh for directories. They answer different questions and often disagree.
• df says full but du does not? A deleted file is still held open, find it with lsof +L1.
• df -i checks inodes. A filesystem can be "full" with space free if it has run out of them.
• du -sh * | sort -h is the fastest way to find where the space actually went.
• Test /etc/fstab with mount -a before rebooting. A bad entry can leave the machine unbootable.
• Use UUIDs in fstab, not /dev/sdX: device names are not stable across reboots.
• tar -czf creates, -xzf extracts, -tzf lists. Always list an unfamiliar archive before extracting.

---

Frequently Asked Questions

What is the difference between df and du?

df asks the filesystem how much space it has allocated, reported per mount point. du walks a directory tree and adds up the files it can see. They answer different questions and legitimately disagree: du misses files you lack permission to read, counts a hard-linked file once while df sees one copy of the data, and ignores space held by deleted-but-open files. Use df -h to find which filesystem is full, then du to find what is filling it.

Why does df show a full disk when du shows plenty of free space?

Almost always a deleted file still held open by a running process. Unlinking a file removes the directory entry, but the blocks are not released until every file descriptor on it closes, so du cannot see it and df still counts it. This happens most often with a log file rotated or deleted while the service holds it open. Find the culprit with sudo lsof +L1, which lists open files with a link count of zero, then restart that process to release the space.

How do I find what is using all my disk space?

Start at the top and work down: sudo du -sh /* 2>/dev/null | sort -h shows which top-level directory is largest, then repeat inside the winner. du -sh * | sort -h at each level narrows it quickly. ncdu does the same interactively and is worth installing. For individual large files, sudo find / -type f -size +500M -exec ls -lh {} \;. On servers the answer is usually /var/log or a container runtime directory such as /var/lib/docker.

What are inodes and why does "no space left on device" appear with free space?

An inode holds a file's metadata, and a filesystem is created with a fixed number of them. Millions of tiny files can exhaust the inode table while gigabytes of space remain, and the kernel reports the generic No space left on device. df -i shows inode usage and confirms it in one command. The fix is deleting files rather than freeing bytes, typically a session directory, a mail spool or a cache that accumulated small files. Only reformatting changes the inode count.

How do I make a mount persist across reboots?

Add a line to /etc/fstab with the device, mount point, filesystem type, options, dump and fsck fields. Use the filesystem UUID from blkid rather than /dev/sdb1, because device names depend on detection order and can change between boots. Pointing a mount at the wrong disk is a genuinely bad outcome. Then test with sudo mount -a, which applies fstab without rebooting. Skipping that test is how a typo becomes an unbootable machine, and adding nofail to the options limits the damage.

What is the difference between tar, gzip and zip?

tar bundles many files into one archive and does not compress. gzip compresses a single file and does not bundle. They are used together, which is what tar -czf archive.tar.gz dir/ does. The z pipes the tar through gzip. zip does both at once and is the more portable choice for anything going to a Windows user. Practical notes: tar -tzf lists an archive's contents without extracting, which is worth doing before unpacking anything you did not create, and unzip -l is the equivalent.