Disk and storage commands cheat sheet
Disk work splits into two instincts that must never blur: reading capacity (df, du, lsblk) and writing to block devices (mount, dd, LVM creation). Every writing row here carries its guardrail — most importantly the dd row, where a swapped argument erases a disk without prompting.
Order of operations when a volume fills up: df -h finds which filesystem, du -h --max-depth=1 drills to which directory, and df -i catches the sneaky case where inodes rather than bytes ran out. The FAQ covers the third possibility — space that frees only after a process restarts.
Space and usage
| Task | Command | Notes |
|---|---|---|
| Free space per filesystem | df -h | -h human units; add -T to show filesystem type, -x tmpfs -x devtmpfs to declutter |
| Inode usage | df -i | 'No space left on device' with df -h showing free space = inode exhaustion (millions of tiny files) |
| One directory's total size | du -sh /var/log | -s summarize, -h human units |
| Biggest directories under a path | sudo du -h --max-depth=1 /var 2>/dev/null | sort -rh | head -n 15 | permission noise silenced; sort -h understands K/M/G suffixes |
| Memory and swap at a glance | free -h | available is the realistic number — buff/cache reclaims itself under pressure |
| Active swap devices | swapon --show | SIZE, USED and PRIO per swap device; free -h shows the total only |
Devices, mounts and fstab
| Task | Command | Notes |
|---|---|---|
| Block device layout with filesystems | lsblk -f | adds filesystem type, UUID and mountpoint to the tree |
| UUIDs for fstab entries | sudo blkid | copy UUID= values from here — never rely on /dev/sdX letters |
| Tree of everything mounted | findmnt | includes bind mounts; narrow with findmnt /mnt/data |
| Mount a filesystem | sudo mount /dev/sdb1 /mnt/backup | mount point must already exist; lsblk confirms the device first |
| Unmount a filesystem | sudo umount /mnt/backup | busy target: fuser -vm /mnt/backup names the holders; umount -l detaches lazily as last resort |
| Check and repair a filesystem | sudo fsck.ext4 -f /dev/sdb1 | unmounted only; the root filesystem is checked via boot or a recovery image |
| Validate fstab before rebooting | sudo findmnt --verify | parses /etc/fstab and reports bad UUIDs and options — cheap boot insurance |
UUID=123e4567-e89b-12d3-a456-426614174000 / ext4 errors=remount-ro 0 1
UUID=550e8400-e29b-41d4-a716-446655440000 /home ext4 defaults,nofail 0 2
//nas.example/share /mnt/nas cifs credentials=/etc/nas.cred,uid=1000,_netdev 0 0
web01:/srv/export /mnt/nfs nfs4 defaults,_netdev 0 0/dev/sdb1 can become /dev/sdc1 after a reboot or a replug. nofail lets the machine boot when a secondary disk is missing, and _netdev postpones network mounts until the network is up, preventing boot hangs. Keep credentials files (the cifs row) at chmod 600.Health and maintenance
| Task | Command | Notes |
|---|---|---|
| SMART overall verdict | sudo smartctl -H /dev/sda | prints PASSED or FAILED — the ten-second drive health check |
| SMART attribute detail | sudo smartctl -a /dev/sda | watch Reallocated_Sector_Cnt and Current_Pending_Sector — rising values precede failure |
| TRIM all SSDs now | sudo fstrim -av | weekly fstrim.timer normally handles this; -a all mounted SSDs, -v reports bytes trimmed |
| Force pending writes to disk | sync | blocks until dirty buffers are written; cheap insurance before snapshots or cable pulls |
| Write an image to a device — DANGEROUS | sudo dd if=image.iso of=/dev/sdX bs=4M status=progress conv=fsync | DESTROYS everything on the target with no confirmation; verify the letter with lsblk -o NAME,SIZE,MODEL first |
of=/dev/sda instead of /dev/sdb quietly overwrites an operating system. Identify the target by size AND model via lsblk -o NAME,SIZE,MODEL, never by letter alone, and prefer status=progress so a hung write is visible. For writing ISOs to USB, a GUI tool such as GNOME Disks or Etcher wraps the same operation with a picker and confirmation.LVM quick reference
| Task | Command | Notes |
|---|---|---|
| Mark a disk as a physical volume (LVM) | sudo pvcreate /dev/sdb1 | partition type 8e is cosmetic — LVM works regardless; whole disks work too |
| Pool PVs into a volume group (LVM) | sudo vgcreate vg_data /dev/sdb1 | the VG is the storage pool you carve volumes from; vgextend adds more later |
| Carve a logical volume (LVM) | sudo lvcreate -n lv_data -L 50G vg_data | still raw space: follow with mkfs.ext4 /dev/vg_data/lv_data and mount |
| Use all remaining space (LVM) | sudo lvcreate -n lv_data -l 100%FREE vg_data | -l (lowercase L) takes extents — percentages of free VG space |
| List every layer (LVM) | sudo pvs; sudo vgs; sudo lvs | one summary table per layer — sizes and free extents at a glance |
| Grow a volume and its filesystem online (LVM) | sudo lvextend -r -L +10G /dev/vg_data/lv_data | -r invokes the right grower: resize2fs for ext4, xfs_growfs for xfs (xfs must be mounted) |
FAQ
How do I check disk usage on Linux?
Two complementary tools: df -h shows free space per mounted filesystem (the capacity view), while du -sh /path measures how much a directory tree occupies (the consumer view). The drill-down for a full disk: df -h to find the full filesystem, then sudo du -h --max-depth=1 /var | sort -rh | head -n 15 repeated level by level until the culprit appears. Always confirm suspected deletions with lsof before assuming.
Disk is full but df -h shows free space — why?
Two classic causes. First, deleted-but-open files: a process still holds a removed log, so its blocks are not released until the process exits. Find them with sudo lsof +L1 (large sizes, names marked deleted), then restart or reload the holding service — journald and long-running app servers are frequent offenders. Second, inode exhaustion: df -i shows IUse% near 100%, meaning millions of tiny files consumed metadata rather than bytes; clearing session/cache trees releases them.
What does du -sh mean?
du estimates disk usage; the flags shape it. -s summarizes — one total for the argument instead of a line per file — and -h renders human-readable units (K, M, G) instead of raw kilobyte blocks. So du -sh /var/log prints a single readable total for that tree. Combine with --max-depth=1 to get one line per immediate child when hunting space hogs.
Can I extend a disk or LVM volume without downtime?
Yes, routinely. With LVM: lvextend -r -L +10G /dev/vg_data/lv_data grows the volume and the filesystem in one step, online — ext4 grows mounted via resize2fs, xfs grows mounted via xfs_growfs (it cannot shrink at all). On cloud VMs without LVM: extend the volume at the provider, grow the partition (growpart from cloud-guest-utils), then grow the filesystem. Snapshot or back up first; growth is low-risk, but it is not zero-risk.
How do I write an ISO to a USB stick safely?
Identify the stick by size and model with lsblk -o NAME,SIZE,MODEL — never trust the device letter alone — then sudo dd if=image.iso of=/dev/sdX bs=4M status=progress conv=fsync. The dangerous part is of=: pointing it at your system disk destroys it instantly, without confirmation. If the stakes feel high, GNOME Disks' Restore Disk Image or Etcher perform the identical write behind a device picker and a confirmation dialog.
Related tools
- IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
- IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
- VLSM calculator — split a block into right-sized subnets by host requirements.