How to Use the ncdu Command to Find and Clean Large Files in Linux

The Agony of the “No Space Left on Device” Error

Every Linux system administrator, developer, and power user eventually encounters the dreaded storage wall: disk utilisation hits 100%, services begin throwing I/O write errors, package managers abort updates, and database daemons crash. When this happens, diagnosing which specific directory, runaway log archive, or forgotten Docker image is consuming all your disk space becomes urgent.

Traditional Linux terminal tools like du -sh * and df -h can identify overall filesystem boundaries, but navigating nested directories with raw du is notoriously slow, painful to sort, and requires piping output through awkward chains of sort -hr | head -n 20. To solve this, developers created ncdu (NCurses Disk Usage), an interactive, terminal-based disk usage analyser that provides rapid scanning, visual bar charts, and instant keyboard navigation directly within the command line.

Installing ncdu on Linux Distributions

ncdu is lightweight, written in pure C, and available in official repositories across all major distributions:

Ubuntu / Debian / Linux Mint

sudo apt update && sudo apt install -y ncdu

RHEL / CentOS Stream / Fedora / Rocky Linux

sudo dnf install -y ncdu

Arch Linux / Manjaro

sudo pacman -S ncdu

Step 1: Running Your First Disk Scan

To scan your current working directory, simply type:

ncdu

Scanning Entire Root Filesystems Safely

When investigating a server running out of space, you typically want to analyse the entire root directory (/). However, scanning root blindly with raw tools can cause the scanner to crawl mounted network drives (NFS), external backup drives, or virtual filesystems like /proc and /sys. To restrict ncdu strictly to your physical root drive, use the -x (one-filesystem) flag:

sudo ncdu -x /

The -x flag instructs ncdu not to cross filesystem boundaries, ensuring rapid scans and preventing infinite recursion through virtual kernel mounts.

Step 2: Navigating the Interactive Interface

Once the scan completes, ncdu presents a clean ncurses interface with directories sorted automatically from largest to smallest:

• Arrow Keys (Up / Down): Move your selection cursor through files and directories.
• Enter (or Right Arrow): Open and navigate into the highlighted subdirectory.
• Left Arrow: Navigate up one level to the parent directory.
• Question Mark (?): Toggle the help and keyboard shortcuts overlay window.
• q: Quit and return to your standard bash/zsh prompt.

Step 3: Interactive Sorting and Deletion

The true power of ncdu lies in its interactive management shortcuts:

Changing Sorting Metrics

• Press s: Cycle sorting by Size (ascending or descending).
• Press c: Sort items by Item Count (useful for identifying directories hoarding millions of tiny inodes).
• Press n: Sort items alphabetically by Name.

Inspecting Item Metadata

Press i while highlighting any file or folder to display an informative metadata dialogue showing its full absolute path, apparent size, disk blocks consumed, and exact filesystem flags.

Deleting Large Files Directly

If you identify a massive deprecated database dump or an obsolete log file you wish to eradicate immediately:

1. Highlight the target file or folder.
2. Press d.
3. ncdu will display a confirmation dialogue: “Are you sure you want to delete this file?”
4. Select Yes to immediately unlink and delete the file from the filesystem.

Warning: Deletion in ncdu is permanent and executes with whatever user permissions you launched the tool with (e.g. root authority when run with sudo). Proceed cautiously before deleting system files.

Exporting Scans for Remote Inspection

On production servers, scanning a busy disk can consume I/O. You can export the scan output to a compressed file and inspect it later on another machine without running a second scan:

# Export scan data to a compressed gzip file
sudo ncdu -1xo- / | gzip > disk_scan.gz

# Open the exported report anytime without scanning
zcat disk_scan.gz | ncdu -f -

Frequently Asked Questions

What is the difference between ncdu and ncdu2?

ncdu2 is a modern rewrite in the Zig programming language that significantly increases scanning performance and reduces memory consumption when scanning filesystems containing tens of millions of files. Standard distribution repositories provide the mature C version by default.

Can I exclude specific directories from an ncdu scan?

Yes. Pass the --exclude flag followed by a pattern (e.g., ncdu --exclude /var/lib/docker /) to skip directories you do not wish to examine.