I am trying to find out what files/folders are using most space on the filesystem

df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda3        94G   85G  4.4G  96% /
tmpfs            16G  7.9G  7.9G  50% /dev/shm
/dev/sda1       477M   82M  370M  19% /boot

I install ncdu to see what is taking space but i still couldn't find out what takes most of the space

1.9 GiB [##        ] /var
    1.2 GiB [#         ] /usr
  372.8 MiB [          ] /lib
  129.7 MiB [          ] /tmp
   79.3 MiB [          ] /boot
   74.8 MiB [          ] /root
   28.6 MiB [          ] /etc
   18.4 MiB [          ] /lib64
   18.1 MiB [          ] /opt
   10.8 MiB [          ] /sbin


I did delete some big log file before posting this thread.I found it strange that it was showing much difference on df -h .On @Pavel Šimerda suggestion i did a soft reboot and here is the output

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda3        94G  3.9G   85G   5% /
tmpfs            16G  236M   16G   2% /dev/shm
/dev/sda1       477M   86M  366M  20% /boot

Why was a reboot needed in this case ?

marked as duplicate by Gilles, Sparhawk, Satō Katsura, Kusalananda, Archemar May 26 '17 at 8:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    Is the output the same after reboot? – Pavel Šimerda May 31 '15 at 17:23
  • 1
    @PavelŠimerda It works but why was reboot needed...check my edit – user2650277 Jun 1 '15 at 5:20
  • 2
    What was the pathname of the big logfile? – Mark Plotnick Jun 1 '15 at 7:54
  • @MarkPlotnick /var/log/nginx...i just wrongly set the error_log to off causing a massive log file – user2650277 Jun 1 '15 at 15:56
  • That's probably a file that is opened, and held open, by syslogd. After you remove the file, run, as root, service rsyslog restart (the name rsyslog may vary depending on your OS) so that it closes the log file. – Mark Plotnick Jun 1 '15 at 16:13

All the tools mentioned in other answers work basically the same way and just differ in presentation. My favorite is ncdu those days and I use du when the former is not available. So the question is now why was the total used space much larger than the sum of all files on the disk and how reboot affected that situation.

First of all you should know that total, used and available space on the disk is just an estimate. But such a discrepency cannot be explained by mere inaccuracy.

The key fact here is that not all files stored in the filesystem are visible through the file system tree. When a program opens a file it takes a reference on it and the file cannot be removed. When for any reasons the file is deleted from the tree, it remains in the filesystem as long as the program holds the reference.

You can list deleted open files to examine which processes in the system hold deleted files and how big those files are using the following command.

lsof -n | grep '(deleted)'

After reboot you're starting with a clean state and the offending processes may have not yet fed so much data into deleted files.

Details of usage statistics vary by filesystem format.


If you don't mind running a GUI, install and run baobab, then click the hard drive you want to analyze.


ncdu usually reports correctly. Did you use sudo when using it?

Furthermore, you could check if there are blocks reserved by the root. Usually 5% of total space is reserved by root, however in your case it seems to be a whole lot of space. Anyways, to check how many reserved blocks are there, issue this command:

sudo tune2fs -l /dev/sda5 | grep "Block count\|Reserved block count"

You can then find out the percentage by comparing the "Reserved block count" with the total "Block count".

  • Good info but reserved blocks are AFAIK not counted as used space. – Pavel Šimerda Jun 1 '15 at 15:53

This command will list all the folders in / sorted from the smallest to the biggest (hence showing the biggest folders at the end of the output) in a human-readable format (using K, M, G, ...):

sudo du -h / | sort -n

If you need to list files as well:

sudo du -ah / | sort -n

Try running this:

du -ha --max-depth 1 2>/dev/null | sort -hr

It will print all files and directories in the current directory in a human-readable format, sorted in descending order.

I think this is the most readable option when considering command-line tools.

Not the answer you're looking for? Browse other questions tagged or ask your own question.