How to Quickly Identify Disk Space Hogs on Linux Servers

During server operations, disk space alerts are common; you can start by logging into the server and running df -Hl to view usage.

To locate the directories or files that fill the disk, a straightforward method is to run du -hs in the root directory and then drill down into each subdirectory.

A more efficient approach uses the -d or --max-depth option of du to limit depth, combined with grep and sort -nr to filter and rank large entries:

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

Alternatively, the find command can quickly locate large files: find / -type f -size +1G -exec du -h {} \; These methods help you pinpoint the main culprits of disk usage.

Sometimes the total size reported by du differs significantly from df because deleted files are still held open. Use lsof +L1 to list such files; you may discover a large log file (e.g., ~28 GB) that was deleted but not released.

Restarting the associated application (e.g., Tomcat) releases the space.

Why does disk space disappear?

Linux reserves about 5 % of disk space for the root user as a safety buffer, which can cause the sum of Used and Avail to be less than the total Size.

You can adjust this reserved percentage with tune2fs: tune2fs -m 1 /dev/vda1 After reducing the reserved space, the previously hidden usage is freed.