How to Quickly Identify Disk Space Hogs on Linux Servers

Understanding Disk Space Alerts

When a server triggers a disk‑space warning, start by checking the overall usage with df -Hl, which displays human‑readable statistics for each mounted filesystem.

Finding Large Directories with du

A simple way is to run du -hs * in the root directory, which lists the size of each top‑level directory. To dig deeper, limit the depth of the search:

du -h -d 2 | grep [GT] | sort -nr
du -h --max-depth=2 | grep [GT] | sort -nr

These commands filter results that are measured in gigabytes (G) or terabytes (T) and sort them from largest to smallest.

Using find for Faster Searches

The find utility can locate files larger than a given size more efficiently: find / -type f -size +1G -exec du -h {} \; Because find scans the filesystem directly, it is often quicker and more flexible than repeated du calls.

Detecting Space Held by Deleted Files

Sometimes the total size reported by du is far less than the space shown as used by df. This discrepancy usually means that deleted files are still open by a process. List such files with: lsof +L1 The output may reveal a large log file (e.g., ~28 GB) that has been removed but remains allocated because the owning process still holds it open. Restarting the associated service (e.g., Tomcat) releases the space.

Adjusting Filesystem Reserved Space

Linux filesystems reserve a percentage of disk space (default 5 %) for the root user to prevent complete exhaustion. To change this reservation, use tune2fs: tune2fs -m 1 /dev/vda1 Setting the reserve to 1 % frees up the previously hidden space, as shown in the before‑and‑after screenshots.

Conclusion

By combining df, du, find, lsof, and tune2fs, administrators can quickly pinpoint the true culprits of disk‑space consumption, resolve hidden usage caused by deleted files, and fine‑tune filesystem reservations to avoid unexpected shortages.