How to Quickly Identify and Free Hidden Disk Space on Linux Servers

During server operations you may receive disk‑space alerts. First check the overall usage with df -Hl as shown in the screenshot below.

To locate the directories or files that fill the disk, a simple method is to run du -hs in the root directory and then drill down into the reported sub‑directories.

A more efficient approach uses du with depth limits and filters for large sizes:

du -h -d 2 | grep [GT] | sort -nr

du -h --max-depth=2 | grep [GT] | sort -nr

These commands list directories whose size is expressed in gigabytes or terabytes and sort them in descending order.

Alternatively, the find command can locate large files directly:

find / -type f -size +1G -exec du -h {} \;

find

is generally faster and more flexible than du. Using either method you can quickly pinpoint the “culprits” that consume disk space.

What if the reported usage doesn’t add up?

Sometimes the total size reported by du is far less than the usage shown by df. This discrepancy often means that deleted files are still held open by processes, so their space is not released.

To reveal such files, use lsof +L1:

lsof +L1

The output may show a large log file (e.g., ~28 GB) that has been deleted but is still open. Restarting the owning service (such as Tomcat) releases the space.

Why does df show less usable space than expected?

Linux filesystems reserve a percentage of the total space (default 5 %) for the root user to ensure critical services can continue operating when the disk is nearly full.

You can adjust this reserved space with tune2fs: tune2fs -m 1 /dev/vda1 The before‑and‑after screenshots illustrate the effect of reducing the reserved percentage, freeing the previously “missing” space.