How to Use the Linux df and du Commands to Find Large Files

The “Disk Full” Panic

Every system administrator eventually receives the dreaded alert: a server has reached 100% disk capacity. When a Linux server runs out of space, catastrophic things happen. Databases crash because they cannot write new entries, websites go offline, and you might not even be able to execute basic commands.

If this happens on a Windows or Mac computer, you open a graphical storage manager and look for the biggest pie chart. On a headless Linux server, you only have the terminal. You must quickly diagnose the problem using two foundational commands: df (Disk Free) to see the big picture, and du (Disk Usage) to hunt down the specific culprits.

Step 1: The Big Picture (df)

The df command tells you how much space is available on all the different hard drives (file systems) connected to your server.

If you just type df and press Enter, the output is nearly unreadable. It displays the sizes in raw blocks (kilobytes), resulting in massive strings of numbers that are difficult to parse.

You must always use the -h (Human-readable) flag.

df -h

The output will instantly transform into something you can understand. It will list every mounted drive, showing its total Size, how much is Used, how much is Avail (Available), and the Use% (percentage). Look for the drive that says 100% Use. Usually, this is the main root partition, mounted at /.

Step 2: Hunting the Culprit (du)

Now that df has confirmed the main drive is full, you need to find out why. Is it a massive database? Did someone upload a 10GB video? Is a log file spiraling out of control?

The du (Disk Usage) command analyzes the size of individual files and directories. If you just type du in the root directory, it will attempt to list the size of every single file on the server, which will crash your terminal.

You need to use three specific flags and combine them with the sort command to create a prioritized list of the biggest folders.

The “Find Large Folders” Command

Navigate to the root directory (cd /) and run this exact command string:

du -sh * | sort -rh | head -n 10

Let’s break down this powerful command chain:

1. du: The command to check disk usage.
2. -s (Summarize): Instead of listing every single file inside a folder, just give me the total combined size of the folder itself.
3. -h (Human-readable): Show the sizes in Megabytes (M) or Gigabytes (G) instead of raw bytes.
4. *: Apply this command to everything in the current directory.
5. | (Pipe): Take the massive list generated by du and send it to the next command.
6. sort -rh: Sort the list Reverse (biggest at the top) and understand Human-readable numbers (so it knows 2G is bigger than 900M).
7. | head -n 10: Only show me the top 10 results, so my screen is not overwhelmed.

Following the Trail

The output of that command might show that the /var/ directory is consuming 80GB of space. You have found the problem area.

You then navigate into that directory (cd /var/) and run the exact same command again:

du -sh * | sort -rh | head -n 10

This time, it might show that the /var/log/ folder is taking up 78GB. You navigate into /var/log/ (cd /var/log/) and run it again. Finally, you discover a single file, perhaps nginx-error.log, that has swollen to 78GB because of a misconfigured web server.

Step 3: Resolving the Issue

Once you find the massive file, you must handle it carefully. You can delete it using the rm command (e.g., rm nginx-error.log), but if a service (like the Nginx web server) is currently actively writing to that file, deleting it might not actually free up the space until you restart the Nginx service.

A safer trick for massive log files is to “truncate” them—emptying their contents without deleting the file itself. You do this by redirecting nothing into the file:

> nginx-error.log

This instantly empties the file to 0 bytes, immediately freeing up the 78GB of disk space and bringing your server back to life.

Conclusion

Managing disk space on a headless server requires a methodical approach. By using df -h to confirm the overall disk status, and strategically deploying du -sh * | sort -rh to drill down into the folder structure, you can quickly locate and eliminate the massive files crashing your system.

Related posts

1. Essential Linux Terminal Keyboard Shortcuts to Work Faster
2. How to Find Large Files and Directories in Linux
3. How to Create and Extract ZIP Files in the Linux Terminal