A full Linux filesystem rarely points to one obvious directory. Ranking directory totals under the affected mount helps separate logs, backups, caches, and application data before the next write fails.
The du command reports allocated disk blocks below each directory. With -x, du stays on the same filesystem; with -h and -d1, it prints readable first-level totals that can be sorted by size without crossing into other mounted volumes.
The parent directory total normally appears first because it includes every child below it. Start with the largest child under that line, repeat the scan one level deeper, and use sudo when permission errors hide protected paths. Confirm the final candidate before deleting database stores, package metadata, container layers, or application-owned state.
Steps to find the largest directories with du in Linux:
- Measure first-level directory usage under the target path.
$ du -xhd1 /srv/audit | sort -hr 625M /srv/audit 441M /srv/audit/backups 121M /srv/audit/images 65M /srv/audit/logs 4.0K /srv/audit/tmp
Replace /srv/audit with the mount point or subtree that is using space unexpectedly. Add sudo when protected directories would otherwise print permission errors.
- Drill into the largest child directory.
$ du -xhd1 /srv/audit/backups | sort -hr 441M /srv/audit/backups 281M /srv/audit/backups/monthly 161M /srv/audit/backups/daily
The first line is the total for the scanned directory itself. Use the largest child path below it for the next pass.
- Increase the depth only after a child directory still dominates the result.
$ du -xhd2 /srv/audit/backups | sort -hr 441M /srv/audit/backups 281M /srv/audit/backups/monthly/full 281M /srv/audit/backups/monthly 161M /srv/audit/backups/daily/app 161M /srv/audit/backups/daily
Deep scans on large trees can add noticeable disk I/O. Move down one level at a time instead of running a very deep scan across the whole filesystem.
- Confirm the final candidate directory before cleanup or exclusion changes.
$ du -shx /srv/audit/backups/monthly/full 281M /srv/audit/backups/monthly/full
Removing package metadata, database stores, container layers, virtual disk images, or application state directly can break software or lose data. Use the workload-specific cleanup path when the directory belongs to an active service.
Related: How to free disk space on Linux
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
