Linux VPS

Find the largest files and folders on a Linux server

Track down what is filling your Linux VPS disk with du, sort, find -size and ncdu, staying on one filesystem so the search is fast and the results make sense.

BeginnerLinux server4 min read

A full disk stops databases, breaks updates and can even block SSH logins. The first job is to find out what is using the space. This guide shows a fast, top-down way to locate the biggest folders and files on a Linux VPS, using tools that are already installed plus one optional interactive viewer.

Before you start

  • A Linux VPS with Ubuntu 22.04 or 24.04, Debian 12, or AlmaLinux or Rocky Linux 8 or 9.
  • An SSH session with sudo. Without it, many folders cannot be measured.
  • A quick look at overall usage, so you know which filesystem is full:
Bash
df -h

The Use% column shows how full each filesystem is. On most VPS setups the root filesystem / is the one that matters. More on reading this output is in Check disk space with df.

Find the biggest top-level folders

Start at / and measure one level down:

Bash
sudo du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -15
  • du measures disk usage.
  • -x stays on the same filesystem, skipping /proc, /sys and other mounts.
  • -h prints sizes like 4.2G.
  • --max-depth=1 shows only one level of folders.
  • sort -rh sorts human-readable sizes, largest first.

Example output:

18G     /
9.6G    /var
4.1G    /usr
2.7G    /home
1.1G    /opt

Then drill down into the largest one and repeat:

Bash
sudo du -xh --max-depth=1 /var 2>/dev/null | sort -rh | head -15

Typical heavy folders are /var/log (logs), /var/lib/docker (containers and images), /var/lib/mysql (databases), /var/cache (package caches) and /home (user files and backups).

List the largest files directly

find can list every file above a size, anywhere on the root filesystem:

Bash
sudo find / -xdev -type f -size +500M -exec ls -lh {} + 2>/dev/null

Lower the limit to +100M if nothing shows up. To see the biggest files sorted by size:

Bash
sudo find / -xdev -type f -size +100M -printf '%s %p\n' 2>/dev/null | sort -rn | head -20 | awk '{printf "%.1f MB  %s\n", $1/1048576, $2}'

-xdev is the find equivalent of du -x. It keeps the search on one filesystem.

Mix files and folders with du -ah

du -a includes files as well as folders, which helps inside one area:

Bash
sudo du -ah /var/log 2>/dev/null | sort -rh | head -20

Use ncdu for an interactive view

ncdu scans once and lets you browse the results with arrow keys. Install it:

Bash
sudo apt install ncdu

On AlmaLinux and Rocky it is in the EPEL repository:

Bash
sudo dnf install epel-release && sudo dnf install ncdu

Run it on the root filesystem only:

Bash
sudo ncdu -x /

Use the arrow keys and Enter to move into folders, and q to quit. Pressing d deletes the selected item after a confirmation, so take care. A full tour is in Analyse disk usage with ncdu.

Common culprits and safe fixes

Warning: Do not delete files you do not recognise, especially under /var/lib, /usr or /boot. Removing database files, packages or kernels by hand can break the server. Use the tool that owns the data instead.

  • Huge logs in /var/log: shrink the system journal with sudo journalctl --vacuum-size=200M, and empty a giant active log with sudo truncate -s 0 /var/log/myapp/app.log rather than deleting it.
  • Package cache: clear it with sudo apt clean or sudo dnf clean all.
  • Docker: check usage with docker system df, then prune unused images and containers.
  • Old backups and archives in home folders: move them off the server, then remove them.

Space still used after deleting

If you delete a big file but df does not change, a running process still holds it open. Find it with:

Bash
sudo lsof +L1

Restart the process shown and the space is released.

Check it works

Run df -h / again. The Used value should drop by roughly the amount you removed. If du on / and df disagree by many gigabytes, look for deleted but open files as shown above.

Troubleshooting

  • du takes ages or shows huge numbers for /proc: you left out -x. Add it so du stays on one filesystem.
  • "Permission denied" lines everywhere: you are not using sudo. Run the command with sudo, or add 2>/dev/null to hide the noise.
  • sort: invalid option -- 'h': very old systems lack sort -h. All supported releases have it, so check you are not inside a minimal container.
  • Disk is 100% full and commands fail: free a little space first, such as sudo apt clean or vacuuming the journal, then continue the search.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.