How to Audit and Clean Disk Space in Linux Using NCurses Disk Usage (ncdu)

Running out of disk space on Linux servers can trigger critical cascading failures, from broken database transactions and crashed web servers to failed SSH authentications. While standard Linux commands like du -sh * and df -h report filesystem consumption, navigating directory trees recursively to locate massive log files, abandoned Docker containers, or forgotten archive backups is tedious and time-consuming.

The ncdu (NCurses Disk Usage) utility provides an interactive, terminal-based disk scanning interface. Combining the speed of du with a curses-driven text UI, ncdu allows administrators to browse directory hierarchies, sort folders by byte size, and delete unneeded files directly from the terminal without leaving the session.

Installing ncdu on Linux Distributions

The ncdu utility is available in the standard repositories of all major Linux distributions:

1. On Ubuntu, Debian, and Linux Mint:

sudo apt update && sudo apt install -y ncdu

2. On CentOS, RHEL, Fedora, and AlmaLinux:

sudo dnf install -y ncdu

3. On Arch Linux and Manjaro:

sudo pacman -S ncdu

Running an Interactive Directory Scan

To audit disk space in your current working directory or a specific filesystem mount:

1. To scan the current working directory:

ncdu

2. To scan an entire production server filesystem starting from root:

sudo ncdu -x /

The -x flag is critical on multi-mount servers: it restricts the scan to the local filesystem only, preventing ncdu from scanning remote NFS mounts, external USB drives, or virtual filesystems like /proc and /sys.

Navigating the ncdu Terminal Interface

Once the scan completes, ncdu presents an interactive directory ledger sorted by disk footprint:

• Up/Down Arrow Keys: Move the cursor between directories and files.
• Enter Key: Open the selected directory to inspect its child folders.
• Left Arrow Key: Move up to the parent directory.
• n Key: Sort items alphabetically by filename.
• s Key: Sort items by disk consumption (default).
• i Key: Display detailed item metadata, including full path, file type, hard link counts, and disk block size.
• q Key: Exit ncdu and return to the shell.

Deleting Unneeded Files and Archives Safely

When you locate abandoned log files, massive database dumps, or obsolete installation archives, you can delete them directly within the ncdu interface:

1. Highlight the target file or directory using the arrow keys.
2. Press the d key.
3. A confirmation prompt appears displaying the item name and warning that deletion is permanent.
4. Select Yes and press Enter.

To run ncdu in read-only mode (preventing accidental deletions when auditing client environments), pass the -r flag:

ncdu -r /var/log

Exporting and Reviewing Scan Results Remotely

Scanning large multi-terabyte disk arrays can take time. You can run ncdu as a background batch job, export results to a compressed file, and inspect the data locally:

1. Execute a background scan and export to gzip:

sudo ncdu -1xo- / | gzip > /tmp/server_disk_scan.json.gz

2. Download the file and load it into ncdu instantly without rescanning:

ncdu -f server_disk_scan.json.gz