Jul 25, 2022

Linux Disk Usage: Find What's Eating Your Storage and Clean It Up

Running out of disk space is one of the most common server issues. Logs grow silently, Docker images pile up, package caches expand, and suddenly your / partition is 95% full. This guide covers every tool you need to find what’s using your disk space and clean it up.

Checking Disk Usage: df

df (disk free) shows how much space is available on each mounted filesystem:

# Human-readable output
df -h

# Output:
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda1       100G   72G   28G  72% /
# /dev/sdb1       500G  450G   50G  90% /data
# tmpfs           7.8G     0  7.8G   0% /dev/shm

Useful variations:

# Show only specific filesystem types
df -h -t ext4

# Show filesystem type column
df -hT

# Show inode usage (important for lots of small files)
df -i

# Show specific mount point
df -h /home

Key Things to Watch

Use% above 90%: Danger zone — some services fail when disk is full
Inode usage: You can run out of inodes before running out of space (millions of tiny files)
tmpfs: RAM-based filesystem — not actual disk usage

Finding Large Directories: du

du (disk usage) shows the size of directories and files:

# Show total size of a directory
du -sh /var/log
# 2.3G    /var/log

# Show size of each subdirectory
du -h --max-depth=1 /var
# 1.2G    /var/lib
# 2.3G    /var/log
# 45M     /var/cache
# 3.5G    /var

# Sort by size (largest first)
du -h --max-depth=1 /var | sort -rh

# Top 10 largest directories from root
du -h --max-depth=1 / 2>/dev/null | sort -rh | head -10

Find the Biggest Space Hogs

# Find top 20 largest files on the entire system
find / -type f -exec du -h {} + 2>/dev/null | sort -rh | head -20

# Find files larger than 100MB
find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null

# Find files larger than 1GB
find / -type f -size +1G -exec ls -lh {} \; 2>/dev/null

# Find large files modified in the last 7 days
find / -type f -size +50M -mtime -7 -exec ls -lh {} \; 2>/dev/null

ncdu: Interactive Disk Usage Analyzer

ncdu is the best tool for exploring disk usage interactively — it’s like a terminal-based file manager for storage.

Install ncdu

# Ubuntu/Debian
sudo apt install ncdu

# macOS
brew install ncdu

# Fedora
sudo dnf install ncdu

Use ncdu

# Scan current directory
ncdu

# Scan a specific directory
ncdu /var

# Scan entire system
sudo ncdu /

# Export scan results for later viewing
sudo ncdu -o /tmp/disk-scan.json /
ncdu -f /tmp/disk-scan.json

Navigation:

Arrow keys: Navigate
d: Delete selected file/directory (with confirmation)
n: Sort by name
s: Sort by size
q: Quit

ncdu is the fastest way to find what’s eating your disk space.

Listing Block Devices: lsblk

lsblk shows all block devices (disks, partitions, LVM volumes):

lsblk
# NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
# sda      8:0    0  100G  0 disk
# ├─sda1   8:1    0   99G  0 part /
# └─sda2   8:2    0    1G  0 part [SWAP]
# sdb      8:16   0  500G  0 disk
# └─sdb1   8:17   0  500G  0 part /data

# Show filesystem type and UUIDs
lsblk -f

# Show size in human-readable format
lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT,UUID

Common Space Wasters and How to Clean Them

1. Log Files

Logs are the #1 space consumer on servers:

# Check log directory size
du -sh /var/log

# Find the largest log files
du -h /var/log/* | sort -rh | head -10

# Truncate a large log file (without deleting it)
sudo truncate -s 0 /var/log/syslog

# Clear old journal logs (keep last 3 days)
sudo journalctl --vacuum-time=3d

# Clear old journal logs (keep last 500MB)
sudo journalctl --vacuum-size=500M

# Check journal disk usage
journalctl --disk-usage

Configure log rotation in /etc/logrotate.conf to prevent logs from growing unbounded.

2. Package Manager Cache

# APT (Ubuntu/Debian)
sudo apt clean              # Remove all cached packages
sudo apt autoclean          # Remove old cached packages
sudo apt autoremove         # Remove unused dependencies
du -sh /var/cache/apt       # Check cache size

# YUM/DNF (Fedora/RHEL)
sudo dnf clean all
du -sh /var/cache/dnf

# Pacman (Arch)
sudo pacman -Sc             # Remove old packages from cache
sudo pacman -Scc            # Remove all cached packages

3. Docker

Docker is notorious for consuming disk space silently:

# Show Docker disk usage
docker system df

# Detailed breakdown
docker system df -v

# Remove unused data (dangling images, stopped containers, unused networks)
docker system prune

# Remove ALL unused data (including unused images)
docker system prune -a

# Remove unused volumes too (WARNING: deletes data volumes)
docker system prune -a --volumes

# Remove specific items
docker image prune          # Remove dangling images
docker container prune      # Remove stopped containers
docker volume prune         # Remove unused volumes
docker network prune        # Remove unused networks

4. Old Kernels (Ubuntu)

# List installed kernels
dpkg --list | grep linux-image

# Remove old kernels (keep current and one previous)
sudo apt autoremove --purge

5. User Cache and Trash

# Check user cache sizes
du -sh ~/.cache
du -sh ~/.local/share/Trash

# Clear user cache
rm -rf ~/.cache/*

# Empty trash
rm -rf ~/.local/share/Trash/*

# npm/yarn cache
npm cache clean --force
yarn cache clean

# pip cache
pip cache purge

6. Snap Packages (Ubuntu)

Snap keeps old versions of packages:

# List snap packages and their disk usage
snap list --all

# Remove old snap revisions
snap list --all | awk '/disabled/{print $1, $3}' | while read name rev; do
  sudo snap remove "$name" --revision="$rev"
done

7. Temporary Files

# Check temp directories
du -sh /tmp /var/tmp

# Clean tmp (be careful on multi-user systems)
sudo rm -rf /tmp/*
sudo rm -rf /var/tmp/*

Monitoring Disk Usage

Set Up Alerts

Create a simple disk usage alert script:

#!/bin/bash
# /opt/scripts/disk-alert.sh

THRESHOLD=90
ALERT_EMAIL="admin@example.com"

df -h | awk 'NR>1 {
  gsub(/%/,"",$5)
  if ($5 > '"$THRESHOLD"') {
    print $6 " is " $5 "% full (" $4 " available)"
  }
}' | while read line; do
  echo "$line" | mail -s "Disk Alert: $(hostname)" "$ALERT_EMAIL"
done

Schedule with cron:

# Check every hour
0 * * * * /opt/scripts/disk-alert.sh

Watch in Real Time

# Watch disk usage update every 5 seconds
watch -n 5 df -h

# Monitor a specific directory
watch -n 10 'du -sh /var/log'

Quick Reference

Command	Purpose
`df -h`	Show filesystem disk usage
`df -i`	Show inode usage
`du -sh /path`	Size of a directory
`du -h --max-depth=1 /path`	Size of subdirectories
`ncdu /path`	Interactive disk explorer
`lsblk`	List block devices
`find / -size +100M`	Find files over 100MB
`docker system prune -a`	Clean Docker storage
`sudo journalctl --vacuum-size=500M`	Trim system logs
`sudo apt clean && apt autoremove`	Clean package cache

Summary

Disk space management is an ongoing task. The key workflow:

Check: df -h to see which partitions are full
Investigate: ncdu / or du -h --max-depth=1 / to find where space is used
Clean: Remove logs, package caches, Docker artifacts, and old files
Monitor: Set up alerts to catch issues before they become emergencies

Key resources:

ncdu: https://dev.yorhel.nl/ncdu
logrotate: man logrotate
Docker cleanup: https://docs.docker.com/config/pruning/

Run df -h regularly, keep ncdu in your toolkit, and your servers will never run out of space unexpectedly.