How to Quickly Identify Disk Space Hogs on Linux Servers

During server operations we often receive disk space alerts. After logging in and running df -Hl to confirm the warning, the next step is to locate the directories or files that fill the disk.

How to Find Large Directories or Files?

A simple method is to run du -hs in the root directory and list the size of each subdirectory, then drill down recursively.

A more efficient approach uses du with the -d or --max-depth option to limit depth, piping the output through grep to filter entries measured in gigabytes or terabytes, and sorting them:

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

Alternatively, the find command can locate large files quickly and flexibly: find / -type f -size +1G -exec du -h {} \; These methods help pinpoint the main culprits of disk usage.

Sometimes the total size reported by du differs significantly from df. This discrepancy often occurs when deleted files still hold space. You can detect such files with lsof +L1: lsof +L1 The output may reveal a large log file (e.g., ~28 GB) that was deleted but not released, which can be resolved by restarting the associated application (e.g., Tomcat).

Why Does Disk Space Appear to Be Missing?

Linux reserves a percentage of disk space for the root user (default 5%) as a safety buffer for critical services. This reserved space can be adjusted with tune2fs: tune2fs -m 1 /dev/vda1 Reducing the reserved percentage frees up the previously hidden space.