Disk usage with du and ncdu
du (disk usage) is the standard Linux command that reports how much space files and directories use; ncdu is an interactive, ncurses-based alternative that lets you browse the results and delete items. Together with df, which shows free space per file system, they are the usual way to find what fills a disk.
1Useful du options
du -sh /var prints one human-readable total. du -h --max-depth=1 / lists the size of each top-level directory. -x stays on one file system, so mounted disks and /proc are skipped.
Piping to sort finds the biggest items: du -xh --max-depth=1 / | sort -h.
2ncdu
ncdu -x / scans the root file system and opens a browsable list sorted by size. Arrow keys move, Enter opens a folder, 'd' deletes the selected item after confirmation, 'q' quits. ncdu is usually installed from the distribution's package (for example apt install ncdu).
3When du and df disagree
If df reports a full disk but du finds less, a deleted file may still be held open by a running process. The space returns when that process closes the file or restarts.
How to find what fills the disk
- See which file system is full:
df -h - List the biggest top-level folders:
sudo du -xh --max-depth=1 / | sort -h - Go one level deeper into the largest folder and repeat.
- Or browse interactively:
sudo ncdu -x /
Cautions
- Do not delete files you do not recognise in
/usr,/lib,/bootor/var/lib. - 'd' in ncdu deletes immediately after you confirm; there is no recycle bin.
Related articles
- df (disk free)How to read df output, why Use% can reach 100% before Avail is zero for normal users, and how to check inodes with df -i.
- Inodes and 'No space left on device'What an inode is, how to see inode usage with df -i, and how to find directories with millions of small files.
- Finding large and old files with findHow to use find to list big or old files on Linux, preview them safely and delete only what you checked.
Sources
- du(1) man7.org
- ncdu(1) (Debian) manpages.debian.org
- df(1) man7.org
Note: RainServer offers monitoring and safe cleanup for Linux servers; it shows what will change and asks first.
Last reviewed: