Sysinternals Du

This post covers the Sysinternals tool Du – Directory disk usage reporter. It is the second post in a series covering the Sysinternals suite of tools to help people discover new ones they may not have used before.

What is Directory disk usage reporter?

Directory disk usage reporter will be very familiar to those who have used Unix/Linux based operating systems. It is basically the equivalent of the du command on those platforms and provides information on the size of a given directory. If you want to know which directories contain the data filling a drive this tool can be most useful – if you’ve used the ‘TreeSize’ program consider Du to be a CLI equivalent. Quite often my team is asked to explain why a system is running low or out of disk space and having an effective tool to assist in this process is vital.

What information does it present and how do I use it?

Running du.exe from the command line by default will list the number of files, directories and size for a given target path having iterated recursively through that path.

As an example, below I execute the command and provide a drive path to examine.

C:\>du c:\Temp

Du v1.5 - report directory disk usage
Copyright (C) 2005-2013 Mark Russinovich
Sysinternals - www.sysinternals.com

Files: 12
Directories: 4
Size: 45,638,983 bytes
Size on disk: 45,686,784 bytes

C:\>

We can view the available command options by simply running du, the help output will display without the need for /? or -? however if you do add these they will bring up the help as expected.

C:\>du

Du v1.5 - report directory disk usage
Copyright (C) 2005-2013 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: du [-c[t]] [-l <levels> | -n | -v] [-u] [-q] <directory>
-c Print output as CSV. Use -ct for tab delimiting.
-l Specify subdirectory depth of information (default is one level).
-n Do not recurse.
-q Quiet (no banner).
-u Count each instance of a hardlinked file.
-v Show size (in KB) of all subdirectories.

CSV output is formatted as:
Path,CurrentFileCount,CurrentFileSize,FileCount,DirectoryCount,DirectorySize

C:\>

To avoid seeing the Sysinternals Du banner every time the command runs you can use the -q Quiet switch. Note the command syntax expects the switch to come before the directory path. Entering the -q switch after the directory will result in nothing being displayed.

C:\>du -q c:\Temp
Files: 12
Directories: 4
Size: 45,638,983 bytes
Size on disk: 45,686,784 bytes

C:\>
C:\>du c:\Temp -q

C:\>

This demonstrates the importance of knowing the command syntax – du expects all switches to come before the directory path. The Sysinternals documentation provides the following as a reference for the command syntax.

  • du [-c[t]] [-n | -l levels | -v] [-u] [-q] directory

Note that you cannot use -n-l or -v together, they are considered to be mutually exclusive which makes sense when you consider what the switches do.

The program works quite happily on mapped drives as shown below. I use the -q switch to suppress the banner and -v to “Show size (in KB) of all subdirectories” –

C:\>du -v -q s:\backups
1,162 s:\backups\pfSense\Archived
1,269 s:\backups\pfSense
4 s:\backups\Synology DS716+II\Archived
15 s:\backups\Synology DS716+II
11 s:\backups\Cisco SG300-20\Archived
23 s:\backups\Cisco SG300-20
6 s:\backups\OpenVPN

Totals:
Files: 23
Directories: 8
Size: 1,346,411 bytes
Size on disk: 1,017,856 bytes

C:\>

The -l switch can be used to determine how many levels deep directory usage is reported on. Let me use the following two command run outputs to demonstrate what I mean by this. First off I will run the command with only two switches, -q to suppress the banner and -v to show the size of subdirectories.

C:\>du -q -v s:\downloads
259 s:\downloads\ClipGrab\imageformats
75,545 s:\downloads\ClipGrab
4,277,248 s:\downloads\ISOs and Images\CentOS
2,072,099 s:\downloads\ISOs and Images\Cisco UCS
633,036 s:\downloads\ISOs and Images\GNS3
2,818,752 s:\downloads\ISOs and Images\Kali Linux
8,590,550 s:\downloads\ISOs and Images\NetApp\vsim_esx-7m
9,836,885 s:\downloads\ISOs and Images\NetApp
624,269 s:\downloads\ISOs and Images\pfSense
10,744 s:\downloads\ISOs and Images\starwind-vsa\StarwindVSA\OVF
4,683,250 s:\downloads\ISOs and Images\starwind-vsa\StarwindVSA
4,683,250 s:\downloads\ISOs and Images\starwind-vsa
1,532,928 s:\downloads\ISOs and Images\Ubuntu\Server
1,532,928 s:\downloads\ISOs and Images\Ubuntu
1,598,179 s:\downloads\ISOs and Images\VMware\Workstation
376,870 s:\downloads\ISOs and Images\VMware\Fusion
1,084,130 s:\downloads\ISOs and Images\VMware\vRealize Orchestrator
15,455,444 s:\downloads\ISOs and Images\VMware\vCloud Suite Standard 7
339,036 s:\downloads\ISOs and Images\VMware\vSphere with Operations Management Enterprise Plus v6.5
2,059,054 s:\downloads\ISOs and Images\VMware\vRealize Operations for Horizon
1,813,070 s:\downloads\ISOs and Images\VMware\vRealize Operations
881,390 s:\downloads\ISOs and Images\VMware\vRealize Log Insight
0 s:\downloads\ISOs and Images\VMware\vSAN
662,615 s:\downloads\ISOs and Images\VMware\Horizon Advanced Edition
15,723,330 s:\downloads\ISOs and Images\VMware\vRNI
2,389,384 s:\downloads\ISOs and Images\VMware\NSX
9,642,228 s:\downloads\ISOs and Images\VMware\vRealize Automation Enterprise
6,360,812 s:\downloads\ISOs and Images\VMware\vCenter
58,385,545 s:\downloads\ISOs and Images\VMware
6,808,810 s:\downloads\ISOs and Images\Microsoft\Server 2016
6,808,810 s:\downloads\ISOs and Images\Microsoft
7,277 s:\downloads\ISOs and Images\Ubiquiti
103,819,555 s:\downloads\ISOs and Images
574,053 s:\downloads\Cisco\Packet Tracer
581,369 s:\downloads\Cisco
38,268 s:\downloads\SysinternalsSuite
942,590 s:\downloads\Win8-1 Drivers

Totals:
Files: 230
Directories: 38
Size: 108,594,787,043 bytes
Size on disk: 55,740,674,048 bytes

C:\>

As you can see the command output iterates through the entire directory tree reporting on each level. Now I will run the same command again but with the -l switch and a value of 1 to only display the information for one directory level deep.

C:\>du -q -l 1 s:\downloads
75,545 s:\downloads\ClipGrab
103,819,555 s:\downloads\ISOs and Images
581,369 s:\downloads\Cisco
38,268 s:\downloads\SysinternalsSuite
942,590 s:\downloads\Win8-1 Drivers
Files: 230
Directories: 38
Size: 108,594,787,043 bytes
Size on disk: 55,740,674,048 bytes

C:\>

 

Now I want to cover my favourite options which allow us to export the returned data as either a comma-separated value (CSV) or tab-delimited. This is where things get really powerful and provide a way to take a large output and manipulate it in another program such as Microsoft Excel.

The required switch is -c which will produce a CSV format or -ct which produces tab-delimited. If we just run the command with the relevant switches it will output the data to the command window, this is OK for the small example directory I use in my example below but for larger runs we will want to re-direct this to either the clipboard or a file.

C:\>du -l 4 -q -c s:\downloads
Path,CurrentFileCount,CurrentFileSize,FileCount,DirectoryCount,DirectorySize
"s:\downloads\ClipGrab\imageformats",2,259,2,1,259
"s:\downloads\ClipGrab",15,75286,17,2,75545
"s:\downloads\ISOs and Images\CentOS",1,4277248,1,1,4277248
"s:\downloads\ISOs and Images\Cisco UCS",6,2072099,6,1,2072099
"s:\downloads\ISOs and Images\GNS3",2,633036,2,1,633036
"s:\downloads\ISOs and Images\Kali Linux",1,2818752,1,1,2818752
"s:\downloads\ISOs and Images\NetApp\vsim_esx-7m",1,8590550,1,1,8590550
"s:\downloads\ISOs and Images\NetApp",6,1246335,7,2,9836885
"s:\downloads\ISOs and Images\pfSense",1,624269,1,1,624269
"s:\downloads\ISOs and Images\starwind-vsa\StarwindVSA\OVF",2,10744,2,1,10744
"s:\downloads\ISOs and Images\starwind-vsa\StarwindVSA",9,4672505,11,2,4683250
"s:\downloads\ISOs and Images\starwind-vsa",0,0,11,3,4683250
"s:\downloads\ISOs and Images\Ubuntu\Server",2,1532928,2,1,1532928
"s:\downloads\ISOs and Images\Ubuntu",0,0,2,2,1532928
"s:\downloads\ISOs and Images\VMware\Workstation",4,1598179,4,1,1598179
"s:\downloads\ISOs and Images\VMware\Fusion",1,376870,1,1,376870
"s:\downloads\ISOs and Images\VMware\vRealize Orchestrator",1,1084130,1,1,1084130
"s:\downloads\ISOs and Images\VMware\vCloud Suite Standard 7",4,15455444,4,1,15455444
"s:\downloads\ISOs and Images\VMware\vSphere with Operations Management Enterprise Plus v6.5",1,339036,1,1,339036
"s:\downloads\ISOs and Images\VMware\vRealize Operations for Horizon",6,2059054,6,1,2059054
"s:\downloads\ISOs and Images\VMware\vRealize Operations",1,1813070,1,1,1813070
"s:\downloads\ISOs and Images\VMware\vRealize Log Insight",1,881390,1,1,881390
"s:\downloads\ISOs and Images\VMware\vSAN",0,0,0,1,0
"s:\downloads\ISOs and Images\VMware\Horizon Advanced Edition",12,662615,12,1,662615
"s:\downloads\ISOs and Images\VMware\vRNI",2,15723330,2,1,15723330
"s:\downloads\ISOs and Images\VMware\NSX",2,2389384,2,1,2389384
"s:\downloads\ISOs and Images\VMware\vRealize Automation Enterprise",2,9642228,2,1,9642228
"s:\downloads\ISOs and Images\VMware\vCenter",3,6360812,3,1,6360812
"s:\downloads\ISOs and Images\VMware",1,1,41,15,58385545
"s:\downloads\ISOs and Images\Microsoft\Server 2016",1,6808810,1,1,6808810
"s:\downloads\ISOs and Images\Microsoft",0,0,1,2,6808810
"s:\downloads\ISOs and Images\Ubiquiti",1,7277,1,1,7277
"s:\downloads\ISOs and Images",16,12139452,90,31,103819555
"s:\downloads\Cisco\Packet Tracer",4,574053,4,1,574053
"s:\downloads\Cisco",1,7316,5,2,581369
"s:\downloads\SysinternalsSuite",99,38268,99,1,38268
"s:\downloads\Win8-1 Drivers",13,942590,13,1,942590
"s:\downloads",6,592266,230,38,106049596

C:\>

Let’s run the same command again twice – once with the output going to the clipboard and then to a file.

Output to clipboard –

C:\>du -l 4 -q -c s:\downloads | clip

C:\>

Output to a file –

C:\>du -l 4 -q -c s:\downloads > c:\temp\du.txt

C:\>

Du output to text file

We can import this into Excel (or paste from the clipboard using the text import wizard), once the data is in Excel we can manipulate it and create graphs if desired.

Du Ouput In Microsoft Excel

Du Ouput Graph

 


I hope you can see just how powerful this tool can be in helping you understand where disk space is being consumed within a directory structure. With the right setup this can also be automated as a scheduled task that creates an output file which can then be e-mailed or dropped somewhere appropriate for end users/technicians to review and assist them in tidying up their drives. I know that we have been able to avoid allocating more SAN storage to various customers by simply demonstrating that their drives were full of junk that once deleted negated the need for any additional storage.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.