How to find the largest files in Linux

When a Linux filesystem fills unexpectedly, the largest file is often easier to miss than the largest directory. Ranking regular files under the affected path helps identify oversized logs, archives, backups, virtual disk images, and dumps before cleanup work starts.

find can walk a directory tree, stay on one filesystem with -xdev, and print each regular file's byte size with its path. Sorting those byte counts in reverse numeric order puts the biggest files first, while numfmt can convert the first column to IEC units without changing the order.

The size printed by %s is the file's apparent size in bytes. Sparse files, compressed filesystems, and copy-on-write storage can make apparent size differ from allocated disk blocks, so inspect the candidate before deleting, truncating, rotating, or moving anything owned by a running service.

Steps to find the largest files with find in Linux:

Rank regular files under the target path by byte size.

$ find /srv/audit -xdev -type f -printf '%s %p\n' | sort --numeric-sort --reverse
44040192 /srv/audit/backups/db-backup.img
18874368 /srv/audit/images/archive.tar
10485760 /srv/audit/logs/app.log
7340032 /srv/audit/logs/app.log.1
1048576 /srv/audit/tmp/session.cache

Replace /srv/audit with the mount point or subtree that is using space unexpectedly. Add sudo when protected directories would otherwise print permission errors.

Convert the byte column to IEC units when the ranked list is easier to scan that way.

$ find /srv/audit -xdev -type f -printf '%s %p\n' | sort --numeric-sort --reverse | numfmt --field=1 --to=iec-i --suffix=B
42MiB /srv/audit/backups/db-backup.img
18MiB /srv/audit/images/archive.tar
10MiB /srv/audit/logs/app.log
7.0MiB /srv/audit/logs/app.log.1
1.0MiB /srv/audit/tmp/session.cache

Keep the raw byte command when exact values are needed for reports or comparisons. numfmt changes only the displayed first field.

Limit the scan to files modified during the suspected growth window.
```
$ find /srv/audit -xdev -type f -mmin -60 -printf '%s %TY-%Tm-%Td %TH:%TM %p\n' | sort --numeric-sort --reverse | numfmt --field=1 --to=iec-i --suffix=B
10MiB 2026-06-13 12:23 /srv/audit/logs/app.log
```
-mmin -60 matches files modified in the last hour. Use -mtime -1 for the last 24 hours, or widen the minute window to match when disk usage started rising.
Inspect the largest candidate before choosing a cleanup action.
```
$ ls -lh --time-style=long-iso /srv/audit/backups/db-backup.img
-rw-r--r-- 1 root root 42M 2026-04-14 01:28 /srv/audit/backups/db-backup.img
```
Large files from databases, containers, virtual machines, package managers, and active log pipelines often need workload-specific cleanup instead of direct removal.
Check allocated disk usage when sparse or copy-on-write files may be involved.
```
$ du -h /srv/audit/backups/db-backup.img
42M	/srv/audit/backups/db-backup.img
```
du reports allocated disk usage for the path, while the earlier find command ranks apparent file size.
Related: How to free disk space on Linux