How to Use the ncdu Command in Linux to Visualise and Free Up Disk Space

When an Ubuntu or Linux server’s root partition unexpectedly hits 100% disk usage, services like Nginx, PostgreSQL, and Docker immediately halt. Diagnosing which hidden directories, unrotated log files, obsolete container images, or application cache dumps are exhausting your disk space is critical. While standard core utilities like df -h identify which filesystem is full, finding the culprit directory traditionally requires tedious, repetitive executions of du -sh * | sort -h across every sub-folder. To provide a blazing-fast, visual, and interactive terminal interface for exploring storage consumption, Linux relies on ncdu (NCurses Disk Usage).

Why ncdu Outperforms Traditional du Commands

The ncdu utility combines the precision of du with a curses-based interactive terminal browser:

• Interactive Directory Drilling: Rather than typing multiple commands to navigate nested folder trees, ncdu lets you drill into directories using arrow keys, instantly revealing which subdirectories consume the most megabytes or gigabytes.
• Relative Proportional Graphing: Automatically displays visual ASCII horizontal bar graphs alongside folder sizes, allowing you to identify storage bottlenecks at a glance.
• In-Place Deletion: Allows administrators to delete bloated log files or obsolete backups directly from within the interface, reclaiming disk space without opening a second terminal window.
• Export and Offline Analysis: Supports exporting scanned filesystem trees into compressed JSON files, allowing you to scan a production server quickly and analyze disk usage offline on your local laptop.

Step-by-Step: Installing ncdu on Linux Distributions

The ncdu binary is available across all major distribution package managers:

On Ubuntu, Debian, and Linux Mint:

sudo apt update
sudo apt install ncdu -y

On Fedora, RHEL, CentOS, AlmaLinux, and Rocky Linux:

sudo dnf install epel-release -y
sudo dnf install ncdu -y

On Arch Linux and Manjaro:

sudo pacman -S ncdu

Running ncdu to Scan Directories

To analyze disk usage, simply pass your target directory to ncdu:

1. Scanning the Current Directory

ncdu

2. Scanning a Specific Path (e.g., /var/log or /home)

sudo ncdu /var/log

3. Scanning the Entire Root Filesystem (-x Flag)

When auditing an entire server, always include the -x (one-file-system) flag. This prevents ncdu from scanning virtual kernel filesystems (like /proc and /sys) or traversing across mounted network drives and external storage volumes:

sudo ncdu -x /

Navigating the Interactive ncdu Interface

Once the scan completes, ncdu presents an indexed list sorted from largest to smallest directory. Navigate using these intuitive keyboard shortcuts:

• Up / Down Arrows (k / j): Move selection cursor through the directory list.
• Right Arrow / Enter (l): Drill into the highlighted directory to inspect its contents.
• Left Arrow (h): Navigate back up to the parent directory.
• d: Prompts to delete the highlighted file or directory immediately. (Use with extreme caution on production servers).
• g: Toggles display mode between graph percentages, exact percentages, or no graph.
• s: Cycles sort order: by size (default), by file count, or alphabetically by name.
• i: Displays an information pop-up card showing full path, item count, and hard link details.
• q: Exits the ncdu interface.

Exporting Scan Results for Fast Repeated Audits

Scanning millions of files across a large NVMe SSD or RAID array can consume considerable I/O bandwidth. You can run the scan once, export the data to a file, and browse it later with zero disk load:

1. Scan and Export to a File

sudo ncdu -x / -o /tmp/disk_audit.json

2. Import and Browse the Audit File Interactively

ncdu -f /tmp/disk_audit.json

This allows you to explore the server’s disk structure instantaneously without triggering any background disk reads.

ncdu vs Traditional du vs Graphical Disk Analysers (Baobab)

Feature	ncdu	Standard du + sort	GNOME Disks / Baobab
Interface Type	Interactive ncurses CLI	Plain text output stream	Desktop GUI application
SSH Remote Usability	Flawless (runs in any terminal)	Flawless	Requires X11 forwarding / VNC
Navigation Speed	Instant arrow-key drilling	Requires typing new commands	Mouse click navigation
In-Place Deletion	Yes (press ‘d’ with confirmation)	No (requires manual rm)	Yes (GUI trash)
Memory Consumption	Extremely lightweight (C binary)	Minimal	Heavy (GTK/Electron overhead)

Troubleshooting Common ncdu Issues

To avoid common scanning hurdles:

• Permission Denied Warnings: If running ncdu / without root privileges, the tool cannot read protected system folders (such as /root or /var/log). Always prefix server audits with sudo.
• Handling Millions of Small Files (ncdu 2.x): If scanning huge enterprise filesystems containing tens of millions of files, standard ncdu can consume substantial RAM. Modern versions of ncdu (version 2.x, written in Zig) feature significantly reduced memory footprints.
• Excluding Specific Folders: To bypass known large directories (like Docker volume directories), pass the --exclude flag: sudo ncdu -x / --exclude /var/lib/docker.

Frequently Asked Questions

Is it safe to delete files using ncdu?

Yes, provided you understand what you are deleting. Pressing d brings up a safety confirmation prompt. Never delete running system files, database journal files, or active shared libraries.

Does ncdu count hard links multiple times?

No. The ncdu engine intelligently tracks hard links, ensuring that hard-linked files are counted only once in overall size calculations.

Can I sort folders by the total number of files instead of size?

Yes. Press c to toggle file counting, then press s to sort by the number of contained files. This is invaluable when diagnosing servers that have run out of filesystem inodes.