How to find the largest directories in Linux

A full Linux filesystem rarely points to one obvious directory. Ranking directory totals under the affected mount helps separate logs, backups, caches, and application data before the next write fails.

The du command reports allocated disk blocks below each directory. With -x, du stays on the same filesystem; with -h and -d1, it prints readable first-level totals that can be sorted by size without crossing into other mounted volumes.

The parent directory total normally appears first because it includes every child below it. Start with the largest child under that line, repeat the scan one level deeper, and use sudo when permission errors hide protected paths. Confirm the final candidate before deleting database stores, package metadata, container layers, or application-owned state.

Steps to find the largest directories with du in Linux:

Measure first-level directory usage under the target path.
```
$ du -xhd1 /srv/audit | sort -hr
625M	/srv/audit
441M	/srv/audit/backups
121M	/srv/audit/images
65M	/srv/audit/logs
4.0K	/srv/audit/tmp
```
Replace /srv/audit with the mount point or subtree that is using space unexpectedly. Add sudo when protected directories would otherwise print permission errors.
Drill into the largest child directory.
```
$ du -xhd1 /srv/audit/backups | sort -hr
441M	/srv/audit/backups
281M	/srv/audit/backups/monthly
161M	/srv/audit/backups/daily
```
The first line is the total for the scanned directory itself. Use the largest child path below it for the next pass.
Increase the depth only after a child directory still dominates the result.
```
$ du -xhd2 /srv/audit/backups | sort -hr
441M	/srv/audit/backups
281M	/srv/audit/backups/monthly/full
281M	/srv/audit/backups/monthly
161M	/srv/audit/backups/daily/app
161M	/srv/audit/backups/daily
```
Deep scans on large trees can add noticeable disk I/O. Move down one level at a time instead of running a very deep scan across the whole filesystem.
Confirm the final candidate directory before cleanup or exclusion changes.
```
$ du -shx /srv/audit/backups/monthly/full
281M	/srv/audit/backups/monthly/full
```
Removing package metadata, database stores, container layers, virtual disk images, or application state directly can break software or lose data. Use the workload-specific cleanup path when the directory belongs to an active service.

Related: How to free disk space on Linux