Find the giants

22
May2020
Kurt Yoder

You have many files and directories on your Linux or Unix server. Normally they sit quietly, waiting for you to look at them. Sometimes they grow enormous while you are not watching! Now you are getting paged because your disk is almost full. What do you do?

What are you du-ing?

On a Linux system, you use the du command at the “root” of your file system to find and summarize each top-level directory size.

For example, here we are using -x to stay on the / (root) filesystem, and sorting by size:

# du -x --max-depth=1 / | sort -n
4       /media
4       /srv
12      /mnt
16      /lost+found
24      /tmp
6932    /bin
7592    /sbin
10652   /etc
20792   /home
22928   /boot.bak
75244   /opt
252124  /lib
715504  /usr
1040008 /root
2059816 /var
4211656 /
Find the giant lion before it eats your free space
Source: Wikipedia

/var is the biggest directory of /. If we descend into /var and again run du, we eventually find the big files:

# ls -ls /var/cache/ | sort
102400 -rw-r--r--  1 root root 104857600 May 22 18:07 its
103424 -rw-r--r--  1 root root 105906176 May 22 18:08 a
104448 -rw-r--r--  1 root root 106954752 May 22 18:08 giant
105472 -rw-r--r--  1 root root 108003328 May 22 18:08 lion
106496 -rw-r--r--  1 root root 109051904 May 22 18:08 get
107520 -rw-r--r--  1 root root 110100480 May 22 18:08 in
108544 -rw-r--r--  1 root root 111149056 May 22 18:08 the
109568 -rw-r--r--  1 root root 112197632 May 22 18:08 car
     4 drwx------  2 root root      4096 Feb 21 10:50 ldconfig
     4 drwxr-xr-x 26 man  man       4096 May 22 06:25 man
     4 drwxr-xr-x  2 root root      4096 Feb 21 10:51 debconf
     4 drwxr-xr-x  2 root root      4096 Nov 13  2018 unbound
     4 drwxr-xr-x  3 root root      4096 May 22 15:36 apt
total 847892

Find it faster

There is a utility that both speeds this up, and keeps things sorted and organized for you: ncdu. Install it using apt/yum install ncdu. Then launch it using ncdu -x /.

screenshot of ncdu showing files and directories in root

ncdu has already ordered the files and directories. It has even preselected the largest directory. Now we hit the “right-arrow” key, and descend all the way to /var/cache:

screenshot of ncdu showing files and directories in /var/cache

From here, you can use the d key to delete files (be careful!), the arrow keys to navigate, or q to exit.

Tips