Find Hidden Linux Disk Usage with df, du, and lsof
A Linux filesystem can report 95% usage in df while du appears to account for much less. The tools are not contradicting each other: they measure different things.
df asks the filesystem about allocated blocks. du walks visible directory entries and sums blocks reachable through those paths. The gap between those views points to several useful troubleshooting cases.
Start with the filesystem view Check filesystems and their types:
Copy df -hT Identify the mount that is actually full. Do not immediately scan recursively from /; container mounts, network filesystems, and bind mounts can make that slow and misleading.
