How to Find Files by Size in Linux using the find Command

Managing Linux Disk Space

When a Linux server’s hard drive suddenly reaches 100% capacity, critical services like MySQL, Nginx, and Docker will immediately crash because they cannot write to their log files. In a panic, system administrators often start randomly navigating directories to hunt down the offending data.

Instead of guessing, you can use the native find command to rapidly scan the entire file system and output a list of files that exceed a specific size threshold (e.g., finding every file larger than 1 Gigabyte).

Using the find Command with the -size Flag

The find command is arguably the most powerful search utility in the Linux ecosystem. By appending the -size parameter, you can filter the search exclusively by file weight.

To search the entire root directory (/) for any file larger than 1 Gigabyte, run the following command as root or using sudo (otherwise you will receive thousands of “Permission denied” errors):

sudo find / -type f -size +1G

Understanding the Syntax

• /: The starting directory. Using the forward slash tells the command to search the entire hard drive recursively. If you only want to search the web server directory, you could change this to /var/www/html/.
• -type f: This ensures the command only returns files. Without this, it might return massive directory structures or block devices.
• -size +1G: The size filter. The + symbol is critical; it means “greater than.” 1G represents 1 Gigabyte.
  • You can use M for Megabytes (e.g., +500M).
  • You can use k (lowercase) for Kilobytes (e.g., +10000k).

Formatting the Output

While the command above will successfully return a list of file paths, it does not actually tell you how big those files are. It just guarantees they are over 1GB.

To make the output useful, you can use the -exec flag to pass every discovered file into the ls -lh (list human-readable) command. This will print the exact size next to the file name.

sudo find / -type f -size +1G -exec ls -lh {} \;

The output will look something like this:

-rw-r--r-- 1 root root 4.2G Jan 15 14:32 /var/log/syslog.1
-rw-r--r-- 1 mysql mysql 12G Feb 02 09:15 /var/lib/mysql/ibdata1
-rw-r--r-- 1 root root 2.1G Jan 28 11:00 /home/user/backup.tar.gz

With this data instantly presented on your screen, you can quickly identify the bloated log file (syslog.1) and delete it to restore stability to your server.