Find large files and directories on Linux

In a hurry? whyfull checks for this and every other common cause in one command.

When a disk is full, the first job is finding where the space went, not deleting things. Work top-down: find the biggest directory, then the biggest directory inside it, until you reach individual files. Only then decide what is safe to remove. Everything in this guide only reads the disk; nothing here deletes anything.

1. See what's full

df -h

df -h shows space per filesystem. Note which filesystem is full (usually /) before searching: searching a different filesystem wastes time and can report files that are not part of the problem.

2. Find the biggest top-level directories

sudo du -xh --max-depth=1 / | sort -h

• -x keeps du on one filesystem, so it does not count other disks mounted under / (for example, a separate /home).
• --max-depth=1 lists only the directories directly under /.
• sort -h puts the biggest last, so it is at the bottom of the output.

Run the same command again inside the biggest directory, and keep drilling down until the directory is small enough to inspect by hand:

sudo du -xh --max-depth=1 /var | sort -h
sudo du -xh --max-depth=1 /var/lib | sort -h

If the total is much smaller than what df reports, stop here and read df says full but du doesn't add up before deleting anything: the missing space is probably deleted files still held open, or files du could not read.

3. Find the biggest individual files

Once a directory looks suspicious, list its largest files directly:

sudo find /var -xdev -type f -printf '%s %p\n' 2>/dev/null | sort -nr | head -20

• -xdev keeps find on one filesystem, like -x does for du.
• -printf '%s %p\n' prints the size in bytes first, so sort -nr sorts largest first.
• 2>/dev/null hides Permission denied errors for files you cannot read. If many errors are hidden, re-run with sudo; without it, find silently misses everything owned by other users or the system, and the biggest file in the list may not be the biggest file on disk.
• To show sizes in human-readable form instead, pipe through numfmt --to=iec:

sudo find /var -xdev -type f -printf '%s %p\n' 2>/dev/null | sort -nr | head -20 | numfmt --field=1 --to=iec

To find only files over a threshold, for example 100 MB, use -size:

sudo find / -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -nr

4. Explore interactively with ncdu

If you prefer to browse instead of running one command per level, ncdu shows the same top-down view interactively and lets you drill into directories with the arrow keys:

sudo ncdu -x /

• -x again keeps it on one filesystem.
• Press d on a selected file or directory to delete it, but only after you have confirmed what it is. ncdu asks for confirmation, but the deletion is permanent: nothing goes to a trash folder.
• If ncdu is not installed, install it from your distribution (sudo apt install ncdu on Ubuntu/Debian, sudo dnf install ncdu on Fedora) or use the du commands above instead.

5. What the results usually mean

6. Before you delete anything

• Confirm the file's owner and age (ls -lh <file>). A large file owned by the system or by a running service is not automatically safe to remove.
• Never delete a file that is still open: deleting it frees nothing until the program closes it, and the program may recreate it. See deleted files still using space.
• If you are unsure what a file is, leave it and ask: the space it uses is rarely worth breaking a service over.