Disk Usage Diagnosis: du, df, and ncdu

Disk is full but df shows high usage while du totals don't add up — can't find what is consuming space.

Use df, du, and ncdu together to find disk hogs. Check for deleted-but-open files.

# Check filesystem usage
df -h

# Find top 20 largest directories from /
du -hx --max-depth=3 / 2>/dev/null | sort -rh | head -20

# Interactive disk usage browser (install if needed)
ncdu /

# Find files larger than 1GB
find / -xdev -size +1G -ls 2>/dev/null

# Deleted files still held open by processes (the classic df/du mismatch)
lsof +L1 | grep '(deleted)'

# Force release: restart or kill the process holding the deleted file
kill -HUP $(lsof +L1 | awk '/deleted/{print $2}' | sort -u)

When a process holds a file descriptor open, the file's inode is not freed even after rm. The space is still consumed from df's perspective but du won't show it. lsof +L1 finds files with link count < 1 (deleted but open).