How to Quickly Identify and Free Hidden Disk Space on Linux Servers

During server operations, disk space alerts are common. After logging into the server and running df -Hl, the reported usage often matches the alert, prompting the need to pinpoint the directories or files consuming the most space.

Finding Large Directories

A simple method is to run du -hs * in the root directory to list each subdirectory's size, then drill down recursively. A more efficient approach uses du -d 2 or du --max-depth=2 combined with grep to filter entries measured in gigabytes or terabytes, and sort -nr to rank them:

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

Alternatively, the find command can locate large files directly: find / -type f -size +1G -exec du -h {} \; Compared to du, find is often faster and more flexible.

Dealing with Discrepancies

Sometimes the total size reported by du (e.g., ~10 GB) is far less than the usage shown by df (e.g., 37 GB). This usually indicates that deleted files are still held open by processes, preventing space release.

Use lsof +L1 to list such files: lsof +L1 In the example, a ~28 GB log file was deleted but still occupied space. Restarting the associated Tomcat application releases the space.

Reserved Filesystem Space

Linux filesystems reserve a percentage (default 5%) of disk space for the root user to ensure critical services remain operational when the disk is full. This reserved space can appear as "missing" space when adding used and available values.

To modify the reserved percentage, use tune2fs: tune2fs -m 1 /dev/vda1 Reducing the reserve from 5% to 1% frees the previously hidden space, as shown in the before‑and‑after screenshots.

By combining these commands— du, find, lsof, and tune2fs —administrators can efficiently locate the root cause of disk usage alerts and reclaim lost storage.