Disk Usage Analysis in Linux: 5 Proven Methods

Introduction / Why This Is Needed

Disk space filling up is one of the most common causes of failures in Linux servers and workstations. When space runs out, services stop, databases fail, and updates cannot be installed. This guide will help you quickly diagnose which specific files and directories consume the most space and make informed decisions about cleaning them up. You will gain a skill that will be useful for any system administrator or developer working with Linux.

Requirements / Preparation

1. Terminal access (Ctrl+Alt+T or SSH connection).
2. Superuser privileges (sudo) for analyzing system directories (/var, /usr) and cleaning package caches. For analyzing your home directory (/home/username), sudo privileges are not required.
3. Basic familiarity with the command line: ability to navigate directories (cd), list contents (ls).
4. Recommended: Install the ncdu utility for the most convenient analysis (instructions below).

Step-by-Step Instructions

Step 1: Quick Overview of Overall Usage (df)

First, find out which filesystems are running low on space.

df -h

• -h — "human-readable", outputs sizes in GB, MB.
• What to look for: The Use% column (percentage used) and Size/Avail (size and available space). Pay attention to lines with 100% or values close to it. Most often, the problem is with /, /var, or /home.

Step 2: Find Largest Directories in the Problematic FS (du)

Find out which directories in the problematic filesystem are the largest. Start from the root (/) or from a specific partition (e.g., /var).

# Analyze root (may require sudo)
sudo du -h --max-depth=1 / 2>/dev/null | sort -hr

# Faster analysis of just /var (a common problem)
sudo du -h --max-depth=1 /var 2>/dev/null | sort -hr

• --max-depth=1 — shows only the size of first-level subdirectories (does not go deeper).
• 2>/dev/null — suppresses "Permission denied" errors (for which you lack permissions).
• sort -hr — sorts by human-readable size in reverse order (largest first).
• Result: You will see a list like 4.5G /var/log. Now you know logs take up 4.5 GB.

Step 3: In-Depth Interactive Analysis (ncdu)

For a visual, interactive exploration, installing ncdu is strongly recommended.

# Installation (choose your OS)
sudo apt update && sudo apt install ncdu   # Debian/Ubuntu
sudo dnf install ncdu                     # RHEL/Fedora/CentOS 8+
sudo yum install ncdu                     # CentOS 7/RHEL 7
sudo pacman -S ncdu                       # Arch

# Run analysis
ncdu /path/to/problem/directory   # e.g., ncdu /var

How to use ncdu:

• Arrow keys ↑/↓ — navigate directories.
• Enter — enter a subdirectory.
• d — delete selected file/directory (will ask for confirmation!).
• q — quit.
• The total size of the current directory is always visible at the bottom of the screen. This is the most effective way to "walk through" the disk and find the elephant.

Step 4: Find Specific Large Files (find)

If you know what you're looking for (e.g., old logs, dumps, cache), use find.

# Find all files in /var/log larger than 500 MB
sudo find /var/log -type f -size +500M -exec ls -lh {} \;

# Find all .log files older than 30 days in your home directory
find ~ -name "*.log" -type f -mtime +30 -exec ls -lh {} \;

# Find 10 largest files IN THE ENTIRE system (slow but thorough)
sudo find / -type f -exec du -h {} + 2>/dev/null | sort -hr | head -20

• -size +500M — files larger than 500 megabytes. Use G for gigabytes, k for kilobytes.
• -mtime +30 — files last modified more than 30 days ago.
• -exec ls -lh {} \; — for each found file, print its size in human-readable format.

Step 5: Clean Package Manager Cache (Quick Win)

Package managers store downloaded .deb/.rpm packages, which can be removed after installation.

# Ubuntu/Debian (APT)
sudo apt clean        # Deletes ALL cache files from /var/cache/apt/archives
sudo apt autoclean    # Deletes only obsolete cache files (safer)

# RHEL/CentOS/Fedora (DNF/YUM)
sudo dnf clean all
sudo yum clean all

This can immediately free up anywhere from 200 MB to several gigabytes.

Verifying the Result

1. Run df -h again for the partition in question. The Use% field should decrease, and Avail should increase.
2. If you used ncdu, you can run it again on the same directory to see how the picture changed.
3. Ensure that services which previously failed due to lack of space are running again (e.g., sudo systemctl status postgresql).

Potential Issues

• ncdu fails to install / command not found.
  • Solution: Ensure you have internet access and up-to-date repositories (sudo apt update). Use the alternative — the du and sort combination from Step 2.
• du or find output many "Permission denied" errors.
  • Solution: This is normal. Run the commands with sudo for system directories (/var, /usr, /opt). For your home directory (/home/your_user), sudo is not needed.
• Deleted a file via ncdu, but space wasn't freed.
  • Solution: The file might have been open by a process. Find the process: sudo lsof | grep /full/path/to/file. Stop the process or restart the service using it. After that, the space will be freed.
• df shows 100%, but du on / shows only 50% usage.
  • Solution: Classic problem! Space is occupied by "invisible" files: deleted but still open by processes (e.g., old logs that were rotated). Find them: sudo lsof | grep deleted. Stop the corresponding process (often systemd-journald or your application), and the space will be freed.