How to Locate Disk Space Hogs on Linux Servers with df, du, find, and lsof

During routine server operations, disk‑space alerts often appear. The first step is to check the overall usage with df -Hl, which shows the filesystem’s total, used, and available space.

Finding Large Directories

A straightforward method is to run du -hs * in the root directory, which lists each top‑level directory’s size. You can then drill down into the largest directories using the same command.

A more efficient approach uses the depth option of du to limit recursion and filter results with grep for gigabyte or terabyte units:

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

This produces a sorted list of directories that consume significant space.

Using find for Faster Searches

The find command can locate large files more quickly and flexibly: find / -type f -size +1G -exec du -h {} \; It searches the entire filesystem for regular files larger than 1 GB and reports their sizes.

Detecting Deleted Files Still Holding Space

Sometimes the space reported by df does not match the sum of sizes from du. This discrepancy often means that deleted files are still open by a process, preventing the kernel from freeing the space.

Use lsof +L1 to list open files that have been deleted: lsof +L1 The output may reveal large log files (e.g., a 28 GB file) that were removed but are still held by a running service such as Tomcat. Restarting the service releases the space.

Reserved Space for Root

Linux filesystems reserve a percentage (default 5 %) of disk space for the root user as a safety buffer. This can make it appear that some space is “missing”. The reservation can be adjusted with tune2fs: tune2fs -m 1 /dev/vda1 Setting the reserved percentage to 1 % frees up space for regular users. After the change, the previously hidden space becomes available.

By combining these commands— df, du, find, lsof, and tune2fs —you can quickly identify and resolve disk‑space issues on Linux servers.