Disk Usage Analysis in Ubuntu: 3 Ways to Find Large Files

Introduction / Why This Is Needed

Running out of disk space is one of the most common problems on Ubuntu servers and home computers. When space runs out, updates stop working, applications break, and the system can become unstable. This guide will show you not just how to check free space (df -h), but how to find the specific files and folders that are "eating it up." You will get a clear picture and be able to make an informed decision about what can be deleted.

Requirements / Preparation

• Access to a terminal (Ctrl+Alt+T) or a graphical shell.
• Administrator privileges (sudo) to analyze system partitions (/, /var) and delete files owned by other users.
• It is recommended to install the ncdu utility—it makes analysis interactive and convenient. Installation instructions are in step 2.
• Be careful! Do not delete system files unless you are 100% sure of their purpose.

Step-by-Step Guide

Step 1: Identify Which Disk Partition is Full

First, you need to understand which specific partition (disk partition or mount point) has exhausted its space.

df -h

Example output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2       50G   45G  3.2G  93% /
/dev/sda1      512M   68M  445M  14% /boot/efi
/dev/sdb1      1.8T  200G  1.5T  12% /mnt/data

Here you can see that the root partition / is 93% full. You need to analyze exactly that one.

Step 2: Install ncdu (Recommended)

ncdu (NCurses Disk Usage) is the best tool for interactive analysis in the terminal. It quickly builds a disk usage tree and allows you to navigate through it.

sudo apt update
sudo apt install ncdu

Step 3: Run the Analysis on the Selected Partition

Run ncdu on the problematic partition. Use sudo to avoid "Permission denied" errors when accessing system directories.

sudo ncdu /

The initial scan may take from a few seconds to several minutes, depending on the partition size and number of files.

Step 4: Explore the Results in ncdu

After scanning completes, you will enter the main interface:

--- / -----------------------------------------------------------------
   45.2 GiB [##########] /usr
    8.5 GiB [####      ] /var
    4.2 GiB [##        ] /home
    1.1 GiB [#         ] /opt
  512.0 MiB [          ] /boot
    ...

How to navigate:

• ↑ ↓ arrows — move through the list.
• ← → arrows or Enter key — enter the selected folder (drill down) or exit from it.
• d key — delete the selected file or folder. WARNING! Deletion is irreversible. ncdu will ask for confirmation.
• q key — exit the program.

What to look for: Look for folders at the top of the list that you didn't expect to see there. Common "candidates":

• /var/cache/apt/archives — cache of .deb packages installed via apt.
• /var/log — logs, especially old or bloated ones (e.g., journal).
• /home/your_user/.cache — cache from browsers, applications (Spotify, VS Code).
• /var/lib/docker — Docker images and containers.
• /var/lib/snapd/snaps — application snaps.
• Directories with backups (*.backup, backup), downloaded videos/ISO images.

Step 5: Alternative: Analysis via Built-in du

If for some reason you cannot or do not want to install ncdu, use the standard du utility combined with sort.

This command will show the 20 largest items (files and folders) in the specified directory (e.g., in /var):

sudo du -sh /var/* 2>/dev/null | sort -rh | head -20

• -s — total size for each argument.
• -h — "human-readable" format (K, M, G).
• 2>/dev/null — suppress "Permission denied" errors.
• sort -rh — sort by size in descending order (reverse, human-numeric).
• head -20 — show only the first 20 lines.

You can replace /var/* with /* to analyze the entire root, but it will be very slow and "noisy".

Step 6: Graphical Method: Baobab (Disk Usage Analyzer)

For those who prefer a GUI, Ubuntu comes with Baobab (Disk Usage Analyzer) pre-installed by default.

1. Open the applications menu and find "Disk Usage Analyzer" or "Анализатор использования диска".
2. Click the "Scan Folder" button (folder icon with a magnifying glass) and select a partition to analyze (e.g., / or /home).
3. Wait for the scan to complete.
4. Interface:
   • "Ring Chart" view (default) — a clear sector diagram. A large sector represents a large folder. Click on a sector to "enter" it.
   • "Tree" view — a hierarchical list with sizes.
   • The bottom of the window shows the path to the currently selected folder and its size.

Baobab is excellent for quick visual orientation.

Verifying the Result

After deleting unnecessary files (e.g., clearing a cache), check if space has been freed.

1. Restart the analysis of the selected partition (ncdu / or baobab).
2. Or use the quick command df -h / to see the overall change in free space on the target partition.

You should see that the size of the "space eater" has decreased, and the Available field in the df output has increased.

Potential Issues

• "Permission denied" error when running ncdu or du.
  • Cause: Attempting to read system directories owned by root.
  • Solution: Run the commands with sudo (sudo ncdu /). Be careful with deletion in this mode.
• Analysis "hangs" or runs very slowly.
  • Cause: A huge number of small files (e.g., in /var/lib/docker/overlay2 or /home/user/.cache) or network file systems (NFS).
  • Solution: Be patient. You can analyze not the entire partition, but a specific "suspicious" folder you already found (e.g., sudo ncdu /var/lib/docker).
• Cannot delete a file via ncdu (the d key doesn't work or the file isn't deleted).
  • Cause: The file is write-protected (the chattr +i attribute) or you are not its owner (even with sudo in some cases for particularly protected files).
  • Solution: Check permissions: ls -la /path/to/file. If the file belongs to another user/group, you may need to change permissions (sudo chown) or attributes (sudo chattr -i), only if you are sure this action is safe.
• Baobab doesn't show some folders or sizes don't match ncdu.
  • Cause: Baobab by default may not account for hard link sizes or some special filesystems (proc, sysfs). It may also skip very small files for speed.
  • Solution: Trust ncdu or du as more accurate and "low-level" tools. Use Baobab for visualization, and ncdu for precision.
• Freed 10 GB, but df -h shows an increase of only 2 GB.
  • Cause: Deleted files are still being held by a running process (e.g., a .log file you deleted but the process continues writing to). Space is not freed until the process closes the file descriptor.
  • Solution: Find the process holding the file: sudo lsof | grep '(deleted)'. The output will show the PID. Restart that process (if safe) or terminate it (sudo kill PID). After this, the space will be freed.