Linux Disk Usage: How to Find and Remove Large Files

Waking up to a "No space left on device" error on a production server is a rite of passage every engineer eventually faces. Last month, I found myself staring at a 100% full partition on a web server that had been running perfectly for months. The culprit wasn't a database spike, but a runaway log file that had ballooned to 40GB.

If you're dealing with similar linux disk usage issues, don't panic. You don't need fancy monitoring suites to find the bloat. You just need to know which tools to reach for.

Why du is your first line of defense

The du (disk usage) command is the old reliable of the Linux ecosystem. It’s pre-installed on every distribution, so you don’t have to worry about dependencies.

When I’m hunting for space, I start at the root and work my way down. My go-to command is:

Bash
sudo du -sh /* 2>/dev/null | sort -h

Here’s why this works:

• -s: Summarizes the size of each directory.
• -h: Makes the output human-readable (GB, MB).
• 2>/dev/null: Silences those annoying "Permission denied" errors.
• sort -h: Puts the largest directories at the bottom, so I don't have to scan the whole list.

If you notice a specific directory is massive, drill down by running sudo du -sh /var/log/* or similar. It’s a bit manual, but it’s effective for narrowing down the scope.

Visualizing bloat with an ncdu tutorial

Sometimes, du feels a bit too slow when you're manually hopping between directories. This is where ncdu (NCurses Disk Usage) shines. It’s an interactive, terminal-based visualizer that makes linux storage management much less of a headache.

If you don't have it installed, grab it via your package manager:

• Debian/Ubuntu: sudo apt install ncdu
• RHEL/CentOS: sudo yum install ncdu

Running sudo ncdu / will scan your drive and give you a navigable interface. You can use your arrow keys to dive into folders, and—my favorite part—press d to delete files directly from the interface. Just be careful; there’s no "undo" button here.

Using find to locate specific large files

When you know a file is large but you aren't sure where it’s hiding, find is the superior tool. While du and ncdu are great for directory-based analysis, if you need to find large files linux systems have scattered across different paths, find is your best friend.

I typically use this command to find anything larger than 500MB:

Bash
sudo find / -type f -size +500M -exec ls -lh {} +

This command searches the entire filesystem, filters for files (-type f), checks the size, and prints the details. If you find a log or an old backup you don't need, you can swap -exec ls -lh {} + with -delete. Warning: Always run the ls version first. You don't want to accidentally delete a compressed database backup or a critical log file that a process is currently writing to.

Identifying open files with deleted handles

Sometimes, you delete a massive file, but the disk space doesn't free up. This happens because a process still has a file handle open to the deleted file. Before you restart services, check if you have "zombie" file handles using Linux Process Management: Using lsof and fuser for Zombie Processes.

You can list these "deleted but still open" files with:

Bash
sudo lsof +L1

If you see a large file here, you’ll need to restart the corresponding service to force it to release the handle and reclaim the space.

Final Thoughts

The most common mistake I see is deleting files that are currently in use by an application, which leads to weird, unpredictable behavior. Before you run rm, always verify that no process is actively writing to the file. If you're managing complex storage environments, you might also be interested in how ZFS Docker Storage: Cutting Disk Footprint with LZ4 Compression can help you avoid these scenarios entirely by making your storage more efficient from the start.

Next time I’d probably set up a cron job to rotate logs more aggressively before they hit that 500MB threshold. Being proactive is always better than chasing down disk space at 2:00 AM.

Frequently Asked Questions

Q: Is it safe to delete files in /tmp? A: Usually, yes, but be careful. Some apps store temporary session files there. It's safer to delete files older than a certain number of days using find /tmp -type f -mtime +7 -delete.

Q: Does ncdu work on remote servers? A: Absolutely. It works perfectly over SSH, which is exactly why it’s my preferred tool for remote linux storage management.

Q: How do I find the largest 10 files in a directory? A: You can combine find and sort: find . -type f -exec du -h {} + | sort -rh | head -n 10.