Running disk space and RAM usage

df answers “how full are the filesystems?” du answers “which folder is fat?” free answers “how much RAM and swap are used?” Together they tell you whether the dedicated server is healthy.

Disk space right now

Free space per filesystem

root@server ~ # df -hroot@server ~ # df -hTroot@server ~ # df -h / /boot /var

Read Use%. Above about 80% on / or /var, start cleaning or expanding LVM. 100% can stop apt, logs, and databases.

Inodes (number of files), not just bytes

root@server ~ # df -i

Note

A disk can be “full” because it ran out of inodes (millions of tiny files) while df -h still shows free bytes. Mail queues and session folders do this.

What is using the space

Largest folders

root@server ~ # du -h --max-depth=1 / 2>/dev/null | sort -hroot@server ~ # du -sh /var/* /home/* /root 2>/dev/nullroot@server ~ # du -sh /var/log /var/lib /var/cache

Biggest files under /var

root@server ~ # find /var -xdev -type f -printf '%s %proot@server ~ # ' 2>/dev/null | sort -n | tail

ncdu is a nicer interactive view:

Interactive disk usage

root@server ~ # apt install -y ncduroot@server ~ # ncdu /

RAM and swap

Human-readable memory

root@server ~ # free -hroot@server ~ # free -mroot@server ~ # watch -n 1 free -h

Column	Meaning
total	Physical RAM the OS sees
used	In use (includes cache depending on view)
available	What new programs can still get — trust this more than “free”
buff/cache	Linux using spare RAM as disk cache. This is normal.
swap	Overflow on disk. Some swap use is OK. Constant heavy swap is slow.

Who is eating RAM

root@server ~ # ps aux --sort=-%mem | headroot@server ~ # apt install -y htoproot@server ~ # htop

In htop, F6 sorts. Watch MEM% and CPU%. Press q to quit. top is always there if htop is not installed.

Classic top and vmstat

root@server ~ # toproot@server ~ # vmstat 1 5root@server ~ # cat /proc/meminfo

Is the disk busy?

I/O snapshot

root@server ~ # apt install -y sysstatroot@server ~ # iostat -xz 1 5root@server ~ # iotop -o

High %util on a disk in iostat means that device is saturated. On RAID1 both members should look similar. If one disk is much slower, check SMART.

Logs filling the disk

Journal and log sizes

root@server ~ # journalctl --disk-usageroot@server ~ # du -sh /var/logroot@server ~ # ls -lhS /var/log | headroot@server ~ # journalctl --vacuum-time=7d

Important note

Do not delete the current log file a process still has open without rotating it. Prefer journalctl --vacuum-time and logrotate.