How to find the largest directories in Linux

Large directory trees are often the fastest way to explain why a filesystem is filling up. Finding the heaviest paths early narrows cleanup to the right subtree before package updates, log growth, backups, or application data push the mount into write failures.

On Linux, du walks a directory tree and totals the disk blocks used below each path. Combining --max-depth with -x keeps the report readable and on one filesystem, while sort -h ranks the largest paths first so the next drill-down target is obvious.

Deep scans can take time on busy or very large filesystems, and the totals reflect allocated disk usage rather than logical file length. Use sudo when protected directories would otherwise be skipped, rerun the scan only on the heaviest subtree from the previous result, and confirm the final candidate before deleting or rotating data.

1. Summarize the immediate subdirectories of the path or mount that looks full.

   $ sudo du -xh --max-depth=1 /var | sort -hr | head -n 10
   4.8M	/var
   4.0M	/var/lib
   504K	/var/cache
   280K	/var/log
   4.0K	/var/tmp
   4.0K	/var/spool
   4.0K	/var/opt
   4.0K	/var/mail
   4.0K	/var/local
   4.0K	/var/backups

   Replace /var with the mount point or subtree that appears to be using space unexpectedly.

2. Scan the filesystem root when the heavy area is still unknown.

   $ sudo du -xh --max-depth=1 / | sort -hr | head -n 12
   106M	/
   100M	/usr
   4.8M	/var
   660K	/etc
   20K	/home
   16K	/run
   12K	/root
   4.0K	/tmp
   4.0K	/srv
   4.0K	/opt
   4.0K	/mnt
   4.0K	/media

   -x keeps the scan on the same filesystem, so nested mounts under the target path do not distort the totals.

3. Rerun the same summary on the largest top-level result to narrow the search.

   $ sudo du -xh --max-depth=1 /var/lib | sort -hr | head -n 12
   4.0M	/var/lib
   3.9M	/var/lib/dpkg
   44K	/var/lib/systemd
   28K	/var/lib/pam
   24K	/var/lib/apt
   4.0K	/var/lib/misc

4. Increase the depth by one level when a single subdirectory still dominates the result.

   $ sudo du -xh --max-depth=2 /var/lib | sort -hr | head -n 12
   4.0M	/var/lib
   3.9M	/var/lib/dpkg
   3.7M	/var/lib/dpkg/info
   44K	/var/lib/systemd
   40K	/var/lib/systemd/deb-systemd-helper-enabled
   28K	/var/lib/pam
   28K	/var/lib/dpkg/triggers
   24K	/var/lib/apt
   20K	/var/lib/dpkg/alternatives
   8.0K	/var/lib/apt/mirrors
   4.0K	/var/lib/misc
   4.0K	/var/lib/dpkg/updates

   Deep scans on large trees can add noticeable disk I/O. Move down one level at a time instead of running a very deep scan across the whole filesystem.

5. Confirm the final candidate directory before cleanup or exclusion changes.

   $ sudo du -shx /var/lib/dpkg
   3.9M	/var/lib/dpkg

   Deleting package metadata, database stores, container layers, or application state directly can break software or lose data. Use the workload-specific cleanup path when the directory belongs to an active service.

   Related: How to free disk space on Linux