How to Find What is Taking Up Disk Space in Linux

This guide helps quickly determine what exactly has consumed space: directories, large files, logs, package manager caches, Docker data, Snap/Flatpak, old kernels, etc.

The tips below assume you have sudo. Be cautious on servers: first diagnosis, then cleanup.

1) Quick Diagnosis: Where Exactly Did the Space Go

Check Filesystem Usage

df -hT

• Use% ~ 100% — the problem is in a specific mount point (e.g., /, /var, /home).
• Type will indicate the filesystem type (ext4, xfs, btrfs, etc.).

Check Inodes (a common cause of "no space", even when gigabytes are available)

df -ih

If IUse% is close to 100%, inodes are exhausted — usually due to millions of small files (cache, spools, temporary files, logs).

2) Find "Heavy" Directories with du

Top Level: What Takes Up the Most in /

To avoid going into other filesystems (e.g., /proc, /sys, other disks), use -x:

sudo du -xhd1 / 2>/dev/null | sort -h

Then delve deeper, for example, if /var is large:

sudo du -xhd1 /var 2>/dev/null | sort -h
sudo du -xhd1 /var/lib 2>/dev/null | sort -h

Useful Flags:

• -h — human-readable sizes
• -d1 — depth 1 level
• -x — do not cross filesystem boundaries

3) Interactive Analysis: ncdu (the most convenient way)

ncdu shows directory sizes and allows you to quickly "drill down" inside.

Installation

# Debian/Ubuntu
sudo apt update && sudo apt install -y ncdu

# Fedora/RHEL/CentOS Stream
sudo dnf install -y ncdu

# Arch
sudo pacman -S ncdu

Running

For the root, without crossing to other filesystems:

sudo ncdu -x /

For a specific partition (e.g., /var):

sudo ncdu -x /var

4) Find the Largest Files (when you need to be specific)

Search for Files Larger than 1 GB on the Current Partition

sudo find / -xdev -type f -size +1G -printf '%s\t%p\n' 2>/dev/null \
  | sort -nr | head -n 50

Top Large Files in a Specific Folder

sudo find /var -xdev -type f -size +200M -printf '%s\t%p\n' 2>/dev/null \
  | sort -nr | head -n 50

If there are too many files, find may take a long time. In such cases, start with du/ncdu.

5) Common "Space Eaters" and How to Check Them

5.1 Logs of systemd-journald

Check how much space the journal is using:

sudo journalctl --disk-usage

Cleanup by size (example: keep up to 500 MB):

sudo journalctl --vacuum-size=500M

Cleanup by time (example: keep 14 days):

sudo journalctl --vacuum-time=14d

Check regular logs:

sudo du -sh /var/log 2>/dev/null
sudo du -sh /var/log/* 2>/dev/null | sort -h | tail -n 20

5.2 Package Manager Cache

Debian/Ubuntu (APT)

sudo du -sh /var/cache/apt 2>/dev/null
sudo apt clean
sudo apt autoremove --purge -y

Fedora/RHEL (DNF)

sudo du -sh /var/cache/dnf 2>/dev/null
sudo dnf clean all
sudo dnf autoremove -y

Arch (pacman)

sudo du -sh /var/cache/pacman/pkg 2>/dev/null
sudo pacman -Sc
# more aggressively (will remove all packages from cache except installed):
# sudo pacman -Scc

5.3 Docker: Images, Containers, Volumes

Summary:

docker system df

Cautious cleanup of "junk" (unused data):

docker system prune

Also remove unused images:

docker system prune -a

Remove unused volumes (often take up a lot):

docker volume prune

Before prune -a, ensure you don’t need old images for rollback.

5.4 Snap and Flatpak

Snap

snap list --all 2>/dev/null | head
sudo du -sh /var/lib/snapd 2>/dev/null

Removing old revisions (approximate approach):

# will show disabled old revisions
snap list --all | awk '/disabled/{print $1, $3}'

# remove a specific revision:
sudo snap remove <name> --revision <rev>

Flatpak

flatpak list 2>/dev/null | head
flatpak uninstall --unused -y

5.5 Old Kernels (Ubuntu/Debian)

Check what is installed:

dpkg -l | grep -E 'linux-image|linux-headers' | grep '^ii'
uname -r

Usually sufficient:

sudo apt autoremove --purge -y

6) When df and du Disagree: Deleted but Open Files

Sometimes a file is deleted, but space is not freed because a process has it open.

Find such files:

sudo lsof +L1

You will see processes and paths like (deleted). The solution is to restart the service/process holding the descriptor (or carefully terminate the process).

7) Useful "Quick Commands" for a Checklist

What Takes Up Space in /var and /home

sudo du -xhd1 /var 2>/dev/null | sort -h
sudo du -xhd1 /home 2>/dev/null | sort -h

Top 20 Largest Directories (deeper)

sudo du -xh /var 2>/dev/null | sort -h | tail -n 20

Check Temporary Directories

sudo du -sh /tmp /var/tmp 2>/dev/null
sudo find /tmp -type f -mtime +7 -print 2>/dev/null | head

8) Preventive Recommendations

• Set up log rotation (logrotate) and limits for journald.
• Monitor the growth of /var/lib (DBs, Docker, caches).
• For Docker — regularly clean up unused images/volumes and limit container log sizes.
• Monitor space and inodes (Prometheus/node_exporter, Zabbix, cron alerts).

Conclusion

Optimal order of actions:

1. df -hT and df -ih — understand what exactly has run out (gigabytes or inodes) and where.
2. du -xhd1 or ncdu -x — find the source directory.
3. Targeted checks of typical culprits: journalctl, package caches, Docker, Snap/Flatpak, old kernels.
4. If the numbers don’t add up — lsof +L1.

If space continues to run out quickly after cleanup, it usually indicates uncontrolled growth of logs/data — consider enabling monitoring and limits.