How to Quickly Identify Disk Space Hogs on Linux Servers

During server operations, disk space alerts are common; you can start by checking usage with df -Hl.

The goal is to pinpoint the directories or files that consume the most space.

Method 1 – Simple du scan : Run du -hs in the root directory to list each top‑level directory’s size, then repeat the command in the larger directories to drill down.

Method 2 – Depth‑limited du with filtering : Use du’s depth options together with grep to show only entries measured in gigabytes or terabytes and sort them.

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

This quickly surfaces the biggest consumers.

Method 3 – Using find : The find command can locate large files more efficiently.

find / -type f -size +1G -exec du -h {} \;

find

is generally faster and more flexible than du for this purpose.

Sometimes the total size reported by du does not match df because deleted files are still held open by processes. List such files with: lsof +L1 In the example, a ~28 GB log file had been deleted but its space was not released; restarting the Tomcat service freed the space.

Another common discrepancy is that df shows used + available less than the total size. Linux filesystems reserve a percentage (default 5 %) of space for the root user to ensure critical services can continue when the disk is full.

You can modify this reservation with tune2fs: tune2fs -m 1 /dev/vda1 After reducing the reserved percentage, the previously “missing” space becomes available.