How to find large files in Linux (and which directories hide them)

When a Linux machine fills its disk, guessing and deleting files is risky. A brief, methodical approach using tools that ship with Linux finds the directories that weigh the filesystem and the individual files inside them.

du (disk usage) measures directory size. Run it as root so it can read every directory instead of producing permission errors: sudo du -h -d 3 /

• sudo: lets du read protected directories so results aren't incomplete.
• -h: prints human-readable sizes (eg 2.6G).
• -d 3: limits depth to three levels so output is scannable rather than an unreadable flood of subdirectories.

Find the large files inside the heavy directory

Once you identify the heavy directory—say /opt/data—use find to list files above your chosen threshold. For files over 100 MB: find /opt/data -type f -size +100M

• -type f: restricts results to files (not directories).
• -size +100M: returns files strictly larger than 100 megabytes. Raise the threshold to filter for only the largest files (for example, +2G for files larger than 2 GB).

Don't delete files before you understand ownership and purpose. Package caches, system journals, databases, and backups belong to applications or system services and often have safe cleanup commands. Examples mentioned in the source:

• apt clean for package cache cleanup.
• journalctl --vacuum-size=200M to shrink systemd journal logs.

If du and find can't account for the disk usage reported by df, a process may be holding a deleted file open. The inode remains allocated until the process releases it. Use sudo lsof +L1 to list deleted-but-still-open files and restart the owning service to free the space.

If you can install software, ncdu provides an interactive, size-sorted view you navigate with arrow keys: sudo ncdu /. That's convenient on machines you control. On locked-down servers where installing packages isn't possible, the du | sort approach works everywhere because it relies only on standard tools.

Two simple commands give a reliable map of disk usage: sudo du -h -d 3 / | sort -h to rank directories by size, then find -type f -size +100M to name the file-level culprits. Use safe cleanup commands or identify the owner before deleting files, and check for deleted-but-open files with sudo lsof +L1 when df shows space used that du and find cannot locate.