How to Quickly Identify Disk Space Hogs on Linux Servers

During server operations we often receive disk‑space alerts. Running df -Hl shows the current usage, but we need to pinpoint the directories or files that fill the disk.

One simple way is to list the size of each top‑level directory with du -hs and then drill down.

More efficient search with depth limits

Use du -d 2 or du --max-depth=2, pipe the output to grep for entries measured in G or T, and sort descending.

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

Alternatively, find can locate large files directly.

find / -type f -size +1G -exec du -h {} \;

find

is generally faster and more flexible than du.

These techniques quickly reveal the biggest space consumers.

Why du and df totals may differ

Sometimes the sum of sizes reported by du is far less than the usage shown by df. This often means space is held by deleted files that are still open.

Use lsof +L1 to list such files.

lsof +L1

In the example a ~28 GB log file had been deleted but its space was not released; restarting the Tomcat service freed it.

Reserved space for the root user

Linux reserves about 5 % of the filesystem for the root user, which can make Used + Avail appear smaller than Size. The reservation can be changed with tune2fs.

tune2fs -m 1 /dev/vda1

After reducing the reserved percentage, the previously “missing” space becomes available.