BTRFS snapshots world be my first guess. ‘sudo btrfs subvolume list /‘
this post was submitted on 08 Oct 2025
34 points (100.0% liked)
Linux
59267 readers
677 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
There is one listed:
ID 256 gen 137604 top level 5 path @rootfs
Looks like it is just my filesystem though?
I typically investigate with ncdu which gives very useful visualization like :
***
/home/fabien/Prototypes/esphome/.esphome ----------------------------------------------------------------------------------------------------------------
/..
3.1 GiB [######################] /platformio
218.1 MiB [# ] /build
28.0 KiB [ ] /idedata
8.0 KiB [ ] /storage
and let's you iterate. Here for example you'd go into platformio and get another view, press d to delete files or directories that aren't needed anymore if it's a stale project e.g. node_modules. Go back, etc.
So yes, warmly recommended, both on desktop and remote servers. It's way easier IMHO that du -sh ./directory then cd, rinse and repeat. It's also way WAY faster then GUI equivalents ... because you navigate and take action, e.g. delete, with your keyboard.
All that being said, if it's about your filesystem rather than your files, it probably won't help much. I don't know enough about btrfs to help unfortunately.
ncdu
Oh this one is very cool! Unfortunately it also only shows the same 101GB being used:
ncdu 1.22 ~ Use the arrow keys to navigate, press ? for help
***
/ ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
93.1 GiB [###########################] /home
6.5 GiB [# ] /usr
790.4 MiB [ ] /var
173.0 MiB [ ] /boot
12.8 MiB [ ] /etc
1.7 MiB [ ] /root
1.3 MiB [ ] /run
44.0 KiB [ ] /tmp
@ 4.0 KiB [ ] initrd.img.old
@ 4.0 KiB [ ] initrd.img
@ 4.0 KiB [ ] vmlinuz.old
@ 4.0 KiB [ ] vmlinuz
@ 4.0 KiB [ ] lib64
@ 4.0 KiB [ ] sbin
@ 4.0 KiB [ ] lib
@ 4.0 KiB [ ] bin
. 0.0 B [ ] /proc
0.0 B [ ] /sys
0.0 B [ ] /dev
0.0 B [ ] /media
e 0.0 B [ ] /srv
e 0.0 B [ ] /opt
e 0.0 B [ ] /mnt
btdu is an excellent tool for finding out what's taking up space in btrfs
Legend! It found a second filesystem named "UNREACHABLE":
It looks like an exact duplicate of my main filesystem "/@rootfs", I'm guessing this is why my disk space filled up. Do you know how I'd go about removing the duplicate? (If it's safe to do so)
There could be btrfs stuff I'm not aware of, but on a file system structure level, do you have a separate drive for booting and then another you added and mounted separately? Or did you install Linux over another install and changed partitions used? The reason I'm asking is you could have a whole drive of data under a folder and then later mount another partition or drive to that same folder. Linux will show you the mounted folder contents, but the original is not visible until you unmount your Mount point. The data is still there. So drive can be full, even though contents look smaller.
I can't say its that for sure, but it has tripped people up before.
But could be btrfs cleanup needs looking at.
I'm not a btrfs expert but AFAIK high unreachable space usage is usually a result of fragmentation. You might want to defragment the filesystem and see if that helps.
I will note that btrfs makes estimations of used/available space very difficult by design, and you especially can not trust what standard UNIX tools like df and du tell you about btrfs volumes. Scripting around du or using ncdu will not help here in any way. You might want to read this kernel.org wiki article as well as the man pages for the btrfs tools (btrfs(8) and particularly btrfs-filesystem(8)), which among other things provide versions of df and du that actually work, or at least they do most of the time instead of never.
Looks like some combination of defragging & balancing has done the trick! The space that was previously marked UNREACHABLE is now UNUSED, and my disk space is back to normal:
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 227G 105G 103G 51% /
Thanks for the wiki link, Btrfs is new to me and I've definitely got some learning to do
Strange, I've never seen that. Have you rebooted the system to make sure it has nothing to do with open files?
I did find one thread that seems related:
https://www.reddit.com/r/btrfs/comments/lip3dk/unreachable_data_on_btrfs_according_to_btdu/
I had the exact same problem on one of my virtual boxes. The problem baffled me for two years and I just added more space to the box a few times to fight it as I couldn't solve the issue. It wasn't the inodes, deleted but open files or anything common like that.
The problem was my mounts. I had occasionally failing mounts combined with crontabs that accessed and wrote data to those mounts. Do you know what happens when you accidentally wrote let's say 200gb data to /mnt/a and then later mount a drive over that mount point? It magically 'disappears' as you'd exclude that mount from the calculations.
Might be you don't have anything mounted and none of the above is useful to you. But this solved my issue and it's quite curious and silly. Just set up mount points to not be writeable and problem went away.
Interesting, this could be it? I haven't configured any mounts on this device yet, but when I tried one of the other suggestions from this thread and use btdu, I get this error:
$ ./btdu -x /
Fatal error: The mount point you specified, "/", is not the top-level btrfs subvolume ("subvolid=5,subvol=/").
It is the btrfs subvolume "subvolid=256,subvol=/@rootfs".
Please specify the path to a mountpoint mounted with subvol=/ or subvolid=5.
E.g.: mkdir /mnt/sda1 && mount -o subvol=/ /dev/sda1 /mnt/sda1 && ./btdu /mnt/sda1
Note that the top-level btrfs subvolume ("subvolid=5,subvol=/") is not the same as the root of the filesystem ("/").
I'm fairly new to the workings of Btrfs so this is jibberish to me right now, but I'll look into it more
EDIT: Nevermind! I was just using the tool wrong. I needed to mount my btrfs "sub-volume" then do the scan against that:
sudo mkdir -p /mnt/btdu
sudo mount -o subvolid=5 /dev/sda1 /mnt/btdu
sudo ./btdu /mnt/btdu
The bit of information you're missing is that du aggregates the size of all subfolders, so when you say du /, you're saying: "how much stuff is in / and everything under it?"
If you're sticking with du, then you'll need to traverse your folders, working downward until you find the culprit folder:
$ du /*
(Note which folder looks the biggest)
$ du /home/*
(If /home looks the biggest)
... and so on.
The trouble with this method however is that * won't include folders with a . in front, which is often the culprit: .cache, .local/share, etc. For that, you can do:
$ du /home/.*
Which should do the job I think.
If you've got a GUI though, things get a lot easier 'cause you have access to GNOME Disk Usage Analyzer which will draw you a fancy tree graph of your filesystem state all the way down to the smallest folder. It's pretty handy.
GUI disk space analyzers are absolutely amazing.
For those who prefer KDE and/or donut graphs, Filelight has you covered.
Bookmarked! Thanks!
I agree with the other suggestions, though if you want a quick and easy GUI tool, I use Filelight
You could try sudo dua i /:
sudo: Without it, it might miss some filesdua: helps a lot with browsing directories and checking for their contents
This was a question we used to ask during job interviews.
You might want to look into your running processes to see if any still have file handles open for the items that have been removed. lsof can be used to find such things.
The shortcut would be to reboot.