How to check log directory sizes in Linux

Log growth under /var/log can turn a warning-level disk alert into failed writes, broken package transactions, or services that stop accepting work. A directory-level size check shows whether plain-text logs, application subdirectories, or the systemd journal are responsible before anyone starts deleting files.

The du command reports allocated disk blocks below each log directory. Running it at one level under /var/log gives a fast map of the main consumers, while --one-file-system keeps the scan from following mounted filesystems that happen to sit below the log tree.

After the directory total points to a candidate, check that subdirectory or list regular files above a threshold with find. Keep the pass read-only; journal files, active daemon logs, database logs, and rotated archives usually need workload-specific retention or rotation changes instead of manual removal.

Steps to check log directory sizes in Linux:

Summarize first-level usage under /var/log.
```
$ sudo du -h --one-file-system --max-depth=1 /var/log
28K	/var/log/apt
185M	/var/log/journal
53M	/var/log/example-app
161M	/var/log/nginx
4.0K	/var/log/private
397M	/var/log
```
The final line is the total for /var/log. Review the largest child directories above it first. If /var/log/journal dominates the result, use the journal-specific size check before changing retention.
Related: How to check systemd journal size in Linux
Drill into the log directory that needs review.
```
$ sudo du -h --all --one-file-system --max-depth=1 /var/log/nginx
64M	/var/log/nginx/error.log.1
96M	/var/log/nginx/access.log
161M	/var/log/nginx
```
--all includes regular files at this level. Omit it when the target directory contains many files and the directory total is enough.

List log files above a chosen threshold on the same filesystem.

$ sudo find /var/log -xdev -type f -size +50M -ls
  3014870 188416 -rw-r--r--   1 root     root     192937984 Jun 13 10:49 /var/log/journal/server/system.journal
  3014868  53248 -rw-r--r--   1 root     root      54525952 Jun 13 10:49 /var/log/example-app/app.log
  3014864  65536 -rw-r--r--   1 root     root      67108864 Jun 13 10:49 /var/log/nginx/error.log.1
  3014861  98304 -rw-r--r--   1 root     root     100663296 Jun 13 10:49 /var/log/nginx/access.log

Raise or lower -size +50M to match the host. -xdev keeps the scan on the filesystem that contains /var/log, and -ls prints file details without needing a sorting pipeline.
Related: How to find the largest files in Linux

Compare the log total with the filesystem free space before cleanup.
```
$ df -h /var/log
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda2        59G   56G  1.2G  98% /
```
Do not remove active log files blindly. Use log rotation, journalctl vacuuming, or the application retention setting so the owning service does not keep writing to a deleted file descriptor.
Related: How to free disk space on Linux