πŸ’‘
⚑
⌨
πŸ”§
🐧
Beginner Bash July 18, 2025 luc

Monitor Linux Disk Usage Real-Time | watch du Command Guide

Monitor Linux Disk Usage Real-Time | watch du Command Guide

Command / Code

Bash Main Command
watch -n 1 'du -sh /path/to/directory | sort -h'

Description

How to Monitor Linux Disk Usage in Real-Time?

Quick Answer: Use watch -n 1 'du -sh /path/to/directory | sort -h' to monitor directory sizes every second. Combine with df -h to check filesystem usage: watch -n 60 'df -h | awk "NR>1 && $5+0 > 80 {print $0}"'. Essential for preventing disk space issues.

Essential Disk Usage Monitoring Commands

# Monitor specific directory in real-time
watch -n 1 'du -sh /var/log | sort -h'

# Monitor multiple directories with sorting
watch -n 1 'du -sh /var/log /tmp /home/* | sort -h'

# Monitor filesystem usage and directory sizes
watch -n 5 'df -h; echo "---"; du -sh /var/log/* | sort -h'

# Monitor with timestamps
watch -n 1 'echo "$(date)"; du -sh /path/to/directory'

# Monitor top 10 largest directories
watch -n 1 'du -sh /* 2>/dev/null | sort -h | tail -10'

# Monitor specific file types
watch -n 1 'find /var/log -name "*.log" -exec du -sh {} \; | sort -h'

# Monitor with file count
watch -n 1 'echo "Files: $(find /path -type f | wc -l)"; du -sh /path'

# Monitor 2 levels deep
watch -n 1 'du -h --max-depth=2 /var | sort -h | tail -20'

# Monitor with percentage usage
watch -n 1 'df -h /var; echo "Directory sizes:"; du -sh /var/* | sort -h'

# Monitor disk I/O activity
watch -n 1 'iostat -d 1 1; echo "---"; du -sh /var/log'

# Quick filesystem overview
watch -n 5 'df -h | grep -E "(Filesystem|/dev/)"'

# Monitor inode usage
watch -n 1 'df -i /var; echo "---"; find /var/log -type f | wc -l'

Frequently Asked Questions

Q: How do I monitor disk usage in real-time on Linux? A: Use watch -n 1 'du -sh /directory' to monitor specific directories every second, or watch -n 5 'df -h' to monitor all filesystems every 5 seconds with human-readable output.

Q: What’s the difference between du and df commands? A: df shows filesystem disk space usage (total, used, available), while du shows directory and file sizes. Use df -h for filesystem overview and du -sh for specific directory sizes.

Q: How do I monitor the largest directories consuming disk space? A: Use watch -n 1 'du -sh /* 2>/dev/null | sort -h | tail -10' to continuously monitor the 10 largest directories in the root filesystem.

Q: How can I monitor disk usage without high CPU usage? A: Increase the watch interval: watch -n 10 'du -sh /large/directory' or use du -s instead of du -sh for faster execution on very large directories.

Q: How do I monitor disk usage with alerts when space is low? A: Combine watch with threshold checking: watch -n 60 'df -h | awk "$5 > 80 {print $0}"' to show filesystems over 80% usage every minute.

Essential Steps to Monitor Linux Disk Usage

  1. Check overall filesystem status: Start with df -h to see total disk usage across all mounted filesystems
  2. Identify problematic directories: Use du -sh /* to find which top-level directories consume most space
  3. Set up real-time monitoring: Use watch -n 5 'df -h' to continuously monitor filesystem usage
  4. Monitor specific directories: Focus on growing directories with watch -n 1 'du -sh /var/log | sort -h'
  5. Track file growth patterns: Monitor with timestamps using watch -n 1 'echo "$(date)"; du -sh /directory'
  6. Implement automated alerts: Create scripts to alert when usage exceeds thresholds for proactive management

Most Important Disk Monitoring Commands

CommandPurposeUse Case
watch -n 5 'df -h'Monitor all filesystemsGeneral system overview
watch -n 1 'du -sh /var/log'Monitor specific directoryTrack log file growth
`du -sh /*sort -h`Find largest directories
`df -hgrep -v tmpfs`Real filesystem usage only
iostat -x 1Monitor disk I/O activityPerformance analysis

What Are the Most Important Disk Monitoring Tools?

Essential File System Commands

# Check filesystem usage
df -h

# Check inode usage
df -i

# Show filesystem types
df -T

# Check specific filesystem
df -h /var

# Show only local filesystems
df -l

Directory Size Analysis

# Show directory sizes (human readable)
du -sh /path/to/directory

# Show sizes one level deep
du -h --max-depth=1 /path

# Show apparent sizes (not disk usage)
du -sh --apparent-size /path

# Exclude specific directories
du -sh --exclude=.git /path

# Show only directories (not files)
du -sh /path/*/

How Do You Monitor Disk Usage Continuously?

Real-Time Monitoring with watch

# Basic filesystem monitoring
watch -n 5 'df -h'

# Highlight changes between updates
watch -d -n 5 'df -h'

# Monitor without header
watch -t -n 1 'du -sh /var/log'

# Exit on command failure
watch -e -n 5 'df -h /nonexistent' 

# Precise timing intervals
watch -p -n 1.5 'du -sh /tmp'

Advanced Monitoring Techniques

# Monitor multiple paths simultaneously
watch -n 1 '
echo "=== Filesystem Usage ===";
df -h | head -5;
echo "=== Directory Sizes ===";
du -sh /var/log /tmp /home | sort -h
'

# Monitor with historical context
watch -n 5 '
echo "Current time: $(date)";
echo "=== Top 5 Largest Dirs ===";
du -sh /* 2>/dev/null | sort -h | tail -5
'

# Monitor disk I/O alongside usage
watch -n 2 '
echo "=== Disk Usage ===";
df -h | grep -E "(Filesystem|/dev/)";
echo "=== I/O Stats ===";
iostat -d 1 1 | tail -n +4
'

Performance-Optimized Monitoring

# Fast monitoring for large directories
watch -n 5 'du -s /large/directory | numfmt --to=iec'

# Monitor only directory totals
watch -n 1 'du -s /var/log /tmp /home | numfmt --to=iec'

# Limit depth to improve performance
watch -n 1 'du -h --max-depth=2 /var | sort -h | tail -10'

# Monitor with timeout for unresponsive systems
timeout 30 watch -n 1 'du -sh /problematic/directory'

How Do You Monitor Specific File Types and Patterns?

File Type Monitoring

# Monitor log files specifically
watch -n 1 'find /var/log -name "*.log" -exec du -sh {} \; | sort -h'

# Monitor image files
watch -n 5 'find /home -name "*.jpg" -o -name "*.png" | xargs du -sh | sort -h'

# Monitor database files
watch -n 1 'find /var/lib/mysql -name "*.ibd" -exec du -sh {} \; | sort -h'

# Monitor temporary files
watch -n 1 'find /tmp -name "tmp*" -exec du -sh {} \; | sort -h'

Pattern-Based Monitoring

# Monitor files modified today
watch -n 5 'find /var/log -newermt today -exec du -sh {} \; | sort -h'

# Monitor large files (>100MB)
watch -n 10 'find /home -size +100M -exec du -sh {} \; | sort -h'

# Monitor growing files
watch -n 1 '
echo "=== Files changed in last minute ===";
find /var/log -newermt "1 minute ago" -exec ls -lh {} \;
'

# Monitor by file age
watch -n 5 'find /tmp -mtime +7 -exec du -sh {} \; | sort -h'

Application-Specific Monitoring

# Monitor Docker volumes
watch -n 5 'du -sh /var/lib/docker/volumes/* | sort -h'

# Monitor web server logs
watch -n 1 'du -sh /var/log/nginx/* /var/log/apache2/* | sort -h'

# Monitor database directories
watch -n 5 'du -sh /var/lib/mysql/* /var/lib/postgresql/* | sort -h'

# Monitor user home directories
watch -n 10 'du -sh /home/* | sort -h'

What Are Advanced Disk Monitoring Techniques?

Multi-Level Directory Analysis

# Three-level deep analysis
watch -n 5 'du -h --max-depth=3 /var | sort -h | tail -20'

# Compare directory sizes over time
watch -n 10 '
echo "$(date)" >> /tmp/disk_usage.log;
du -sh /var/log >> /tmp/disk_usage.log;
tail -10 /tmp/disk_usage.log
'

# Monitor directory growth rate
watch -n 5 '
current=$(du -s /var/log | cut -f1);
echo "Current size: $current KB";
if [ -f /tmp/last_size ]; then
  last=$(cat /tmp/last_size);
  diff=$((current - last));
  echo "Growth: $diff KB since last check";
fi;
echo $current > /tmp/last_size
'

System Resource Integration

# Monitor disk usage with CPU and memory
watch -n 5 '
echo "=== System Resources ===";
free -h | head -2;
echo "=== Disk Usage ===";
df -h | head -5;
echo "=== Top Disk Consumers ===";
du -sh /var/* | sort -h | tail -5
'

# Monitor with network I/O
watch -n 2 '
echo "=== Network ===";
cat /proc/net/dev | head -3;
echo "=== Disk I/O ===";
iostat -d 1 1 | tail -n +4;
echo "=== Disk Usage ===";
df -h | grep -E "/dev/"
'

# Complete system monitoring
watch -n 5 '
echo "=== $(date) ===";
echo "Load: $(uptime | cut -d, -f3-)";
echo "Memory: $(free -h | awk "NR==2{print $3\"/\"$2}")";
echo "Disk: $(df -h / | awk "NR==2{print $3\"/\"$2\" (\"$5\")\")";
echo "Top directories:";
du -sh /* 2>/dev/null | sort -h | tail -3
'

Automated Threshold Monitoring

# Alert when filesystem usage exceeds threshold
watch -n 60 '
echo "=== Filesystem Alert Check ===";
df -h | awk "
  NR>1 && $5+0 > 80 { 
    print \"WARNING: \" $6 \" is \" $5 \" full\" 
  }
  NR>1 && $5+0 > 90 { 
    print \"CRITICAL: \" $6 \" is \" $5 \" full\" 
  }
"
'

# Monitor and log threshold breaches
watch -n 300 '
df -h | awk "
  NR>1 && $5+0 > 85 { 
    print strftime(\"%Y-%m-%d %H:%M:%S\") \" ALERT: \" $6 \" is \" $5 \" full\" >> \"/var/log/disk_alerts.log\"
  }
"
'

When Should You Use Different Monitoring Approaches?

Development Environment Monitoring

# Monitor project directories during development
watch -n 1 'du -sh ~/projects/*/node_modules | sort -h'

# Monitor build outputs
watch -n 5 'du -sh ~/projects/*/build ~/projects/*/dist | sort -h'

# Monitor log files during testing
watch -n 1 'du -sh /var/log/application.log /tmp/debug.log'

# Monitor temporary files
watch -n 5 'du -sh /tmp/* | sort -h | tail -10'

Production Server Monitoring

# Critical system monitoring
watch -n 30 'df -h | awk "$5+0 > 80 {print $0}"'

# Application data monitoring
watch -n 60 'du -sh /var/lib/mysql /var/lib/postgresql /opt/data | sort -h'

# Log rotation monitoring
watch -n 300 'du -sh /var/log/* | sort -h | tail -10'

# Backup monitoring
watch -n 600 'du -sh /backup/* | sort -h'

High-Performance System Monitoring

# Low-overhead monitoring
watch -n 10 'df -h | grep -E "/(home|var|tmp|opt)"'

# I/O performance monitoring
watch -n 1 'iostat -x 1 1 | grep -E "(Device|sd[a-z])"'

# Memory-mapped file monitoring
watch -n 5 'cat /proc/meminfo | grep -E "(MemTotal|MemAvailable|Buffers|Cached)"'

# Large filesystem monitoring
watch -n 30 'df -h | grep -E "/(data|storage|archive)"'

What Are All Disk Monitoring Command Options?

ToolKey OptionsDescription
df-h, -i, -T, -lFilesystem usage, inodes, types, local only
du-s, -h, --max-depth, --excludeDirectory sizes, human readable, depth limit
watch-n, -d, -t, -eInterval, highlight changes, no title, exit on error
iostat-x, -d, -hExtended stats, disk only, human readable
find-size, -mtime, -newermtFile size, modification time, recent changes
lsof+D, -sDirectory usage, file sizes
ncdu-x, -rStay on filesystem, read-only mode
tree-h, -sHuman readable, show sizes

What Are Essential Disk Monitoring Security Practices?

Permission-Safe Monitoring

# Monitor without triggering permission errors
watch -n 5 'du -sh /home/* 2>/dev/null | sort -h'

# Use sudo for system directories
sudo watch -n 1 'du -sh /var/log/* | sort -h'

# Monitor accessible directories only
watch -n 5 'find /var -maxdepth 1 -readable -exec du -sh {} \; | sort -h'

# Check permissions before monitoring
[ -r /path/to/directory ] && watch -n 1 'du -sh /path/to/directory'

Resource-Conscious Monitoring

# Limit CPU usage with longer intervals
watch -n 30 'du -sh /large/directory'

# Monitor with nice to lower priority
nice -n 19 watch -n 1 'du -sh /path'

# Use ionice for I/O priority control
ionice -c 3 watch -n 5 'du -sh /path'

# Limit monitoring scope
watch -n 1 'du -sh --max-depth=1 /path | sort -h | head -10'

Automated Monitoring Scripts

#!/bin/bash
# disk_monitor.sh - Safe disk monitoring with limits

WATCH_PATH=${1:-/var/log}
INTERVAL=${2:-5}
MAX_DEPTH=${3:-2}

# Validate path exists and is readable
if [ ! -r "$WATCH_PATH" ]; then
    echo "Error: Cannot read $WATCH_PATH"
    exit 1
fi

# Monitor with resource limits
timeout 300 watch -n "$INTERVAL" "
    echo 'Monitoring: $WATCH_PATH (max depth: $MAX_DEPTH)';
    du -h --max-depth=$MAX_DEPTH '$WATCH_PATH' 2>/dev/null | sort -h | tail -20
"

How Can You Create Useful Disk Monitoring Aliases and Scripts?

Essential Aliases

# Add to ~/.bashrc
alias diskwatch='watch -n 5 "df -h"'
alias bigdirs='du -sh /* | sort -h | tail -10'
alias logwatch='watch -n 1 "du -sh /var/log/* | sort -h"'
alias homewatch='watch -n 5 "du -sh /home/* | sort -h"'
alias diskfull='df -h | awk "$5+0 > 80 {print $0}"'

Advanced Monitoring Functions

# Smart disk monitoring function
diskmon() {
    local path=${1:-/}
    local interval=${2:-5}
    local depth=${3:-1}
    
    if [ ! -d "$path" ]; then
        echo "Error: Directory $path does not exist"
        return 1
    fi
    
    watch -n "$interval" "
        echo 'Monitoring: $path';
        echo 'Updated: $(date)';
        echo '=== Filesystem Usage ===';
        df -h '$path';
        echo '=== Directory Sizes ===';
        du -h --max-depth=$depth '$path' | sort -h | tail -20
    "
}

# Growth tracking function
track_growth() {
    local dir=${1:-/var/log}
    local logfile="/tmp/disk_growth_$(basename $dir).log"
    
    while true; do
        size=$(du -s "$dir" | cut -f1)
        echo "$(date '+%Y-%m-%d %H:%M:%S') $size" >> "$logfile"
        
        if [ -s "$logfile" ]; then
            echo "=== Growth Tracking for $dir ==="
            tail -10 "$logfile"
            
            # Calculate growth rate
            if [ $(wc -l < "$logfile") -gt 1 ]; then
                last_size=$(tail -2 "$logfile" | head -1 | awk '{print $3}')
                growth=$((size - last_size))
                echo "Growth since last check: $growth KB"
            fi
        fi
        
        sleep 60
    done
}

# Alert function for disk usage
disk_alert() {
    local threshold=${1:-80}
    local email=${2:-"admin@localhost"}
    
    df -h | awk -v threshold="$threshold" -v email="$email" '
    NR>1 && $5+0 > threshold {
        cmd = "echo \"ALERT: Filesystem " $6 " is " $5 " full\" | mail -s \"Disk Alert\" " email
        system(cmd)
        print "Alert sent for " $6 " (" $5 " full)"
    }'
}

Comprehensive Monitoring Script

#!/bin/bash
# comprehensive_disk_monitor.sh - Complete disk monitoring solution

show_usage() {
    echo "Usage: $0 [options]"
    echo "Options:"
    echo "  -p PATH     Path to monitor (default: /)"
    echo "  -i INTERVAL Update interval in seconds (default: 5)"
    echo "  -t THRESHOLD Alert threshold percentage (default: 80)"
    echo "  -d DEPTH    Directory depth (default: 2)"
    echo "  -l LOGFILE  Log file for alerts (default: /tmp/disk_alerts.log)"
    echo "  -h          Show this help"
}

# Default values
MONITOR_PATH="/"
INTERVAL=5
THRESHOLD=80
DEPTH=2
LOGFILE="/tmp/disk_alerts.log"

# Parse command line options
while getopts "p:i:t:d:l:h" opt; do
    case $opt in
        p) MONITOR_PATH="$OPTARG" ;;
        i) INTERVAL="$OPTARG" ;;
        t) THRESHOLD="$OPTARG" ;;
        d) DEPTH="$OPTARG" ;;
        l) LOGFILE="$OPTARG" ;;
        h) show_usage; exit 0 ;;
        *) show_usage; exit 1 ;;
    esac
done

# Validate inputs
if [ ! -d "$MONITOR_PATH" ]; then
    echo "Error: Directory $MONITOR_PATH does not exist"
    exit 1
fi

if ! [[ "$INTERVAL" =~ ^[0-9]+$ ]] || [ "$INTERVAL" -lt 1 ]; then
    echo "Error: Interval must be a positive integer"
    exit 1
fi

# Main monitoring function
monitor_disk_usage() {
    watch -n "$INTERVAL" "
        echo '=== Disk Usage Monitor ===';
        echo 'Path: $MONITOR_PATH';
        echo 'Threshold: $THRESHOLD%';
        echo 'Updated: $(date)';
        echo '';
        
        echo '=== Filesystem Usage ===';
        df -h '$MONITOR_PATH';
        
        echo '';
        echo '=== Alert Check ===';
        df -h '$MONITOR_PATH' | awk 'NR>1 && $5+0 > $THRESHOLD {
            print \"WARNING: \" $6 \" is \" $5 \" full (threshold: $THRESHOLD%)\";
            print strftime(\"%Y-%m-%d %H:%M:%S\") \" ALERT: \" $6 \" is \" $5 \" full\" >> \"$LOGFILE\"
        }';
        
        echo '';
        echo '=== Top Directories ===';
        du -h --max-depth=$DEPTH '$MONITOR_PATH' 2>/dev/null | sort -h | tail -15
    "
}

# Start monitoring
echo "Starting disk usage monitoring..."
echo "Press Ctrl+C to stop"
monitor_disk_usage

What Commands Are Related to Disk Monitoring?

  • df – Display filesystem disk space usage
  • du – Display directory space usage
  • iostat – Display I/O statistics for devices and partitions
  • iotop – Display I/O usage by processes
  • lsof – List open files and their disk usage
  • ncdu – NCurses disk usage analyzer
  • tree – Display directory tree with sizes
  • fdisk – Manage disk partitions
  • parted – Partition manipulation program
  • lvs/pvs/vgs – LVM management commands

Common Disk Monitoring Problems and Solutions

“Permission denied” When Monitoring System Directories

Problem: Cannot monitor certain directories due to insufficient permissions

Diagnosis:

# Check directory permissions
ls -ld /var/log /tmp /home

# Test access
du -sh /var/log 2>&1 | grep "Permission denied"

# Check current user permissions
whoami
groups

Solutions:

# Use sudo for system directories
sudo watch -n 5 'du -sh /var/log/* | sort -h'

# Monitor only accessible directories
watch -n 5 'find /var -maxdepth 1 -readable -exec du -sh {} \; | sort -h'

# Redirect errors to avoid clutter
watch -n 5 'du -sh /var/* 2>/dev/null | sort -h'

# Add user to appropriate groups
sudo usermod -a -G adm,systemd-journal $USER

High CPU Usage During Monitoring

Problem: watch and du commands consuming excessive CPU resources

Diagnosis:

# Monitor CPU usage of watch processes
top -p $(pgrep watch)

# Check system load
uptime
iostat -c 1 5

# Monitor I/O wait times
iostat -x 1 5

Solutions:

# Increase monitoring interval
watch -n 30 'du -sh /large/directory'

# Use lower priority
nice -n 19 watch -n 5 'du -sh /path'

# Limit monitoring depth
watch -n 5 'du -h --max-depth=1 /path | sort -h'

# Use du -s for summary only
watch -n 5 'du -s /path | numfmt --to=iec'

# Monitor fewer directories
watch -n 5 'du -sh /var/log /tmp | sort -h'

watch Command Hanging or Freezing

Problem: watch command becomes unresponsive during monitoring

Diagnosis:

# Check if watch process is running
ps aux | grep watch

# Check system resources
free -h
df -h

# Check for disk I/O issues
iostat -x 1 3

# Look for hung processes
ps aux | grep " D "

Solutions:

# Kill hanging watch processes
pkill watch

# Use timeout to prevent hanging
timeout 300 watch -n 5 'du -sh /path'

# Monitor with built-in limits
watch -n 10 'timeout 30 du -sh /large/path'

# Check filesystem health
sudo fsck /dev/device

# Use alternative monitoring
iostat -x 5

Inaccurate Disk Usage Reports

Problem: du and df showing different space usage

Diagnosis:

# Compare du vs df
df -h /var
du -sh /var

# Check for deleted files still held open
lsof +L1

# Check hidden files
du -sh /var/.*

# Check for sparse files
du -sh --apparent-size /var

Solutions:

# Restart services holding deleted files
sudo systemctl restart service-name

# Find processes with deleted files
lsof | grep deleted

# Use both du and df for complete picture
watch -n 5 'echo "=== df output ==="; df -h /var; echo "=== du output ==="; du -sh /var'

# Check for hardlinks affecting counts
find /var -type f -links +1

# Clear deleted file handles
sudo fuser -k /var/deleted-file

Memory Issues with Large Directory Monitoring

Problem: System runs out of memory when monitoring large directories

Diagnosis:

# Monitor memory usage during du operations
watch -n 1 'free -h; ps aux | grep du'

# Check swap usage
swapon -s

# Monitor process memory
ps -o pid,user,args,pmem,rsz -p $(pgrep du)

Solutions:

# Limit du output
watch -n 5 'du -sh /large/path | head -20'

# Use streaming approach
watch -n 5 'find /large/path -maxdepth 1 -exec du -sh {} \; | sort -h | tail -10'

# Break down monitoring
watch -n 5 'for dir in /large/path/*/; do echo $dir; du -sh "$dir"; done | tail -20'

# Use external tools for large directories
watch -n 10 'ncdu -o- /large/path | head -20'

# Increase system limits
sudo sysctl vm.max_map_count=262144

Network Filesystem Monitoring Issues

Problem: Slow or hanging monitoring on NFS/CIFS mounts

Diagnosis:

# Check mount status
mount | grep nfs
df -h | grep nfs

# Test network connectivity
ping nfs-server
showmount -e nfs-server

# Check NFS statistics
nfsstat -c

Solutions:

# Use longer intervals for network filesystems
watch -n 60 'du -sh /mnt/nfs-share'

# Add timeout for network operations
watch -n 10 'timeout 30 du -sh /mnt/nfs-share'

# Monitor local filesystems only
watch -n 5 'df -l -h'

# Use soft mount options
# Add 'soft,timeo=30' to /etc/fstab

# Monitor network filesystem separately
watch -n 30 'df -h | grep nfs'

Time Synchronization Issues in Monitoring

Problem: Timestamps in monitoring output are incorrect

Diagnosis:

# Check system time
date
timedatectl status

# Check NTP synchronization
ntpq -p
chronyc sources

# Check timezone
ls -la /etc/localtime

Solutions:

# Enable NTP synchronization
sudo timedatectl set-ntp true

# Set correct timezone
sudo timedatectl set-timezone America/New_York

# Force time sync
sudo chrony makestep

# Use UTC in monitoring scripts
watch -n 5 'echo "UTC: $(date -u)"; du -sh /path'

# Sync with specific NTP server
sudo ntpdate pool.ntp.org

Log File Rotation Affecting Monitoring

Problem: Monitoring results change dramatically due to log rotation

Diagnosis:

# Check logrotate configuration
sudo cat /etc/logrotate.conf
sudo ls /etc/logrotate.d/

# Check for recent rotation
sudo ls -la /var/log/*.gz
sudo journalctl -u logrotate

# Monitor during rotation
watch -n 1 'ls -lh /var/log/syslog*'

Solutions:

# Monitor total log space including rotated logs
watch -n 5 'du -sh /var/log/application.log*'

# Exclude compressed logs from size calculations
watch -n 5 'du -sh /var/log/*.log'

# Monitor log rotation events
watch -n 60 'sudo journalctl -u logrotate --since "1 hour ago" | tail -10'

# Account for rotation in alerts
# Check both current and total log sizes

# Monitor log growth rate instead of absolute size
watch -n 5 'stat -c "%Y %s" /var/log/application.log'

Container and Virtual Environment Monitoring

Problem: Monitoring Docker containers or VMs shows confusing results

Diagnosis:

# Check container disk usage
docker system df

# Check Docker volumes
docker volume ls
du -sh /var/lib/docker/volumes/*

# Check overlay filesystem usage
df -h | grep overlay

Solutions:

# Monitor container-specific paths
watch -n 5 'docker system df'

# Monitor host filesystem excluding containers
watch -n 5 'du -sh /var --exclude=/var/lib/docker'

# Monitor specific container volumes
watch -n 5 'du -sh /var/lib/docker/volumes/* | sort -h'

# Use Docker-specific monitoring
watch -n 10 'docker stats --no-stream'

# Monitor VM disk images
watch -n 30 'du -sh /var/lib/libvirt/images/*'

Mastering real-time disk usage monitoring in Linux requires understanding multiple tools and techniques for different scenarios, from development environments to production systems, ensuring proactive storage management and preventing system failures due to disk space issues.

Detailed Explanation

Command Breakdown

  1. watch -n 1:
    • watch: A Linux utility that repeatedly runs a command and displays its output, allowing you to monitor changes in real time.
    • -n 1: Specifies the interval (in seconds) between each execution of the command. Here, it runs the command every 1 second. You can adjust this value (e.g., -n 5 for every 5 seconds).
    • Purpose: Ensures the disk usage information is continuously updated, making it ideal for observing changes during active file operations (e.g., downloads, backups, or log file growth).
  2. ‘…’:
    • The single quotes enclose the command to be executed by watch. This ensures that the entire command, including the pipe (|), is treated as a single unit.
  3. du -sh /path/to/directory:
    • du: Disk usage command, which estimates file and directory space usage.
    • -s: Summarizes the total size of the specified directory and its contents.
    • -h: Displays the size in a human-readable format (e.g., KB, MB, GB instead of bytes).
    • /path/to/directory: The target directory you want to monitor (e.g., /home/user, /var/log, or any valid path). Replace this with the actual directory path you’re interested in.
    • Result: Outputs the total size of the directory and its subdirectories. For example, running du -sh /home/user might output 1.2G if the directory uses 1.2 gigabytes.
  4. | sort -h:
    • |: The pipe operator sends the output of du -sh /path/to/directory to the next command (sort).
    • sort: Sorts the input lines.
    • -h: Enables human-readable sorting, so sizes like 1K, 500M, 2G are sorted correctly (e.g., 1K < 500M < 2G). Without -h, sorting would treat sizes as strings, leading to incorrect ordering (e.g., 10K might appear after 1G).
    • Note: If du -sh only outputs a single line (the total size), sort -h has no effect. However, if you modify the command to omit -s (e.g., du -h /path/to/directory), it lists sizes of all subdirectories, and sort -h organizes them by size, making the output more useful for directories with many subfolders.

How It Works Together

  • The du -sh /path/to/directory command calculates the total size of the specified directory and its contents in a human-readable format.
  • The output is piped to sort -h to ensure proper sorting (though this is more relevant if -s is omitted to list subdirectories).
  • The watch -n 1 wrapper runs this command every second, continuously updating the terminal with the latest disk usage information.
  • The result is a real-time display of the directory’s size, which refreshes every second.

Example ScenarioSuppose you’re downloading files to /home/user/downloads and want to monitor how much disk space the directory is using as files are added. You run:

bash

watch -n 1 'du -sh /home/user/downloads | sort -h'

The terminal might show:

1.5G /home/user/downloads

After a second, if more files are added, it updates to:

1.7G /home/user/downloads

This continues updating every second until you stop the command with Ctrl+C.Example with SubdirectoriesIf you want to monitor the sizes of all subdirectories within /home/user, you can modify the command to:

bash

watch -n 1 'du -h /home/user --max-depth=1 | sort -h'
  • –max-depth=1: Limits du to the specified directory and its immediate subdirectories.
  • Output might look like:
4.0K /home/user/.cache
100M /home/user/documents
1.5G /home/user/downloads
2.0G /home/user

This updates every second, with subdirectories sorted by size.

Related Commands

Tip Actions

Quick Actions