Drill: Find What Is Consuming Disk Space

Goal

Use du, sort, and ncdu to identify directories and files consuming the most disk space.

Setup

• Linux system with coreutils installed
• Optional: install ncdu (apt install ncdu or yum install ncdu)

Commands

Check overall disk usage:

df -h

Find the top 10 largest directories under root:

du -h --max-depth=1 / 2>/dev/null | sort -hr | head -20

Drill into a suspect directory:

du -h --max-depth=1 /var | sort -hr | head -10

Find the single largest files on the system:

find / -type f -printf '%s %p\n' 2>/dev/null | sort -rn | head -20 | awk '{printf "%.1fM %s\n", $1/1048576, $2}'

Use ncdu for interactive exploration:

ncdu /var/log

Check for deleted files still holding space (via lsof):

lsof +L1 2>/dev/null | head -20

What to Look For

• /var/log is a frequent offender with large or rotated log files
• Container runtimes often fill /var/lib/docker or /var/lib/containerd
• Temporary build artifacts accumulate in /tmp or home directories
• ncdu allows drilling down interactively and deleting from within the UI

Common Mistakes

• Running du / without --max-depth and waiting forever for output
• Forgetting to redirect stderr (2>/dev/null) when scanning protected directories
• Not checking for deleted-but-open files that still consume space
• Using ls -l to check sizes, which does not account for sparse files or directory contents

Cleanup

No cleanup needed for the inspection commands. If you delete files, verify the service using them does not need them.