du
what is taking the spacedu — disk usage — walks a directory tree and totals the space taken by every file beneath it. Where df reports on whole filesystems, du reports on directories, so it is how you track a full disk down to the thing that filled it.
Summarise, sort, and descend: du -sh * | sort -h finds the largest directory at each level.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
-s summarises and -h makes the size readable. Without -s, du prints a line for every sub-directory beneath.
--max-depth=1 lists each directory directly under /var. sort -h orders by size, understanding G and M, and tail keeps the largest four.
/var/lib holds 6.8 GB — databases and container images usually live there. That is where to look next.
du always ends with the directory it was given. It is larger than the children shown because smaller directories were cut off by tail.
Switches
A switch changes how the command behaves. These are the ones used day to day; man du lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-s- Summarise: print one total for each argument, not every sub-directory.
-h- Human-readable sizes: K, M, G.
-a- All: report files as well as directories.
-c- Add a grand total at the end.
-d NUM- Report only NUM levels deep. --max-depth=NUM is the same.
-x- Stay on one filesystem: do not cross into other mounted disks.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
du -sh * | sort -hSizes everything in the current directory, largest last.
du -ah . | sort -h | tail -10Finds the ten largest files and directories beneath here.
sudo du -xh --max-depth=1 / | sort -hSizes the top of the tree. -x stays on the root filesystem and skips other disks.
du -sh ~/.cacheChecks one directory — caches are often the easiest space to win back.
In cybersecurity
Disk usage that grows without explanation is one of the plainer signs that something is wrong.
A log growing by gigabytes a day may be an attack being recorded. A large new directory in /tmp or a home directory may be data staged for removal.
As an ordinary user du skips the directories it cannot read and under-reports. The "Permission denied" lines are the parts it missed.
If df says the disk is full but du cannot account for it, a deleted file is probably still held open by a running process. "lsof +L1" lists them.