Disk and Storage Management
# CHAPTER 12
Disk and Storage Management
1. Introduction
A Linux server can run perfectly for three years without a single reboot. However, the silent killer of all servers is a full hard drive. When a massive database or an aggressive log file consumes 100% of the disk space, the operating system physically cannot write another byte of data. It panics, databases corrupt, and the web server crashes. Managing storage is a daily responsibility for system administrators. Furthermore, because Linux treats everything—even a physical USB drive—as a file, adding new hard drives requires a firm grasp of the filesystem architecture. In this chapter, we will learn how to monitor storage capacities usingdf and du, and we will demystify the complex process of partitioning and "mounting" storage hardware.
2. Learning Objectives
By the end of this chapter, you will be able to:-
Monitor global disk space usage across all partitions using
df.
-
Identify specific massive directories or files consuming space using
du.
-
Understand the Linux
/devdirectory and how hardware is represented.
- Explain the concept of "Mounting" a partition to the filesystem tree.
-
Mount and Unmount storage devices using the
mountandumountcommands.
3. Monitoring Disk Space (df and du)
When an alert fires stating the server is out of space, you must investigate immediately.
1. The df Command (Disk Free):
df shows you the overall capacity of your hard drives.
*Output Analysis:* Look at the Use% column. If the / (Root) filesystem is at 99%, you have a critical emergency.
2. The du Command (Disk Usage):
If df tells you the drive is full, du tells you exactly *who* is filling it up. It calculates the size of specific folders.
4. The /dev Directory (Device Files)
In Linux, everything is a file. If you plug a 2TB Samsung SSD into a Linux server, it does not pop up as the D:\ drive.
Instead, the Linux kernel detects the hardware and creates a special text file inside the /dev (Devices) directory to represent it.
-
Your primary hard drive is usually named
/dev/sda.
-
If you plug in a second hard drive, it becomes
/dev/sdb.
-
If you partition that second drive into two sections, they become
/dev/sdb1and/dev/sdb2.
lsblk - List Block Devices).*
5. The Concept of Mounting
You cannot write data directly to the/dev/sdb1 hardware file. You must attach the physical hardware to your existing "Upside-Down Tree" filesystem. This is called Mounting.
Imagine /dev/sdb1 is a physical bucket. To put water (data) into the bucket, you must cut a hole in your filesystem tree and hang the bucket there.
Usually, administrators create empty folders inside the /mnt (Mount) directory to act as these attachment points.
6. Mounting and Unmounting Data
1. Mounting a Drive: Let's attach our new USB drive (/dev/sdb1) so we can use it.
Now, if you type cd /mnt/usbdrive and create a file, you are physically writing data onto the USB stick!
2. Unmounting a Drive:
You must never physically pull a USB drive out of a Linux machine while it is mounted. Data will corrupt. You must safely eject it using umount (Un-mount).
7. Diagrams/Visual Suggestions
*Visual Concept: The Mounting Process* Draw two separate objects:-
1.
The Linux Filesystem Tree (Root
/at top, branching down to/home,/var,/mnt).
-
2.
A physical USB Drive hardware icon labeled
/dev/sdb1.
/mnt folder on the tree.
Label the arrow: mount /dev/sdb1 /mnt/usb. This visualizes that the hardware is being grafted onto the existing software tree.
8. Best Practices
-
Persistent Mounting (
/etc/fstab): If you run themountcommand, the drive works perfectly. But when you reboot the server, the drive will be unmounted. To make a mount permanent across reboots, administrators must edit a highly sensitive configuration file called the File System Table (/etc/fstab). Be extremely careful; a typo infstabwill cause the server to permanently crash on its next boot sequence.
9. Common Mistakes
-
"Device is Busy" Errors: When trying to unmount a drive (
umount /mnt/usbdrive), you receive a "target is busy" error. This means a program is actively using the drive. The most common culprit? *You.* If your terminal is currently sitting inside the/mnt/usbdrivefolder (cd /mnt/usbdrive), the system cannot eject it. You mustcd ~to leave the directory before you can unmount it.
10. Mini Project: The Forensic Storage Hunt
Simulate tracking down a massive rogue file:-
1.
Type:
df -h. Look at the/mount point. Note its capacity.
- 2. Let's pretend the drive is full. We must hunt down the largest folders.
-
3.
Type:
sudo du -sh /* 2>/dev/null.
-
4.
Scan the list. You will likely see that
/usror/varis consuming gigabytes of data.
-
5.
Drill down! Type:
sudo du -sh /var/* 2>/dev/null.
-
6.
You will see
/var/logis the culprit. By recursively chainingducommands, you can narrow down a 1TB drive to a single 500GB runaway log file in minutes.
11. Practice Exercises
-
1.
Differentiate the operational purpose of the
dfcommand versus theducommand. Which one would you use to find the size of a specific user's home folder?
-
2.
Explain the fundamental concept of "Mounting" in the Linux ecosystem. Why must a hardware device in
/devbe mounted before a user can interact with it?
12. MCQs with Answers
You are responding to a critical alert indicating a server is out of disk space. Which command will instantly provide a human-readable summary of the total capacity, used space, and available space across all mounted filesystems?
When attempting to safely unmount a secondary hard drive mapped to /mnt/data, the system throws a "target is busy" error. What is the most common and immediate cause of this error?
13. Interview Questions
-
Q: A junior engineer plugs a 4TB external hard drive into a Linux server and complains they cannot find the
E:\drive to start copying files. Explain to them how Linux registers hardware devices in the/devdirectory and walk them through the exact commands required to make the drive usable.
-
Q: You execute a
df -hcommand and notice the root partition/is at 100% capacity. Explain the step-by-step forensic methodology you would use with theducommand to pinpoint the exact directory causing the outage.
-
Q: Explain the critical role of the
/etc/fstabconfiguration file in Linux storage management. What catastrophic event occurs if an administrator makes a syntax error within this file?
14. FAQs
Q: I deleted a 50GB log file usingrm, but df -h still says the hard drive is 100% full! Why?
A: If a program (like Apache or a Python script) is still actively writing data to a file when you delete it, Linux removes the file name from the directory tree, but it *keeps the data physically on the hard drive* until the program closes. You must restart the program (sudo systemctl restart apache2) to force it to let go of the invisible file and instantly free the 50GB of space.
15. Summary
In Chapter 12, we tackled the physical logistics of the server. We deployeddf to monitor macro-level partition capacities and wielded du to perform micro-level forensic hunts for massive rogue directories. We dismantled the Windows paradigm of isolated drive letters, embracing the Linux philosophy where physical hardware exists merely as text files within the /dev directory. Finally, we mastered the critical administrative process of Mounting—physically grafting external hard drives and USB hardware onto our existing logical filesystem tree, and safely unmounting them to preserve data integrity.