How to Find Large Files Taking Up Disk Space

Running out of disk space is one of the most common causes of unexpected downtime on Linux VPS servers. When a disk hits 100% capacity, MySQL crashes, system logs fail to write, cron jobs abort, and user logins can fail completely.

In this tutorial, you will learn how to identify large files, analyze directory sizes, and reclaim storage on your RivinCloud VPS.

1. Checking General Filesystem Utilization

First, inspect the available storage on your mount points:

df -h

Look at the Use% on / (the root filesystem). If it is above 90%, you need to free up storage immediately.

2. Locating Massive Files with find

The find command can scan your entire server filesystem for files exceeding a specific threshold.

Finding Files Larger Than 100MB

sudo find / -xdev -type f -size +100M -exec ls -lh {} + | awk '{ print $5, $9 }' | sort -hr

Note: The -xdev flag prevents the search from crossing into virtual filesystems like /proc or /sys.

Finding the Top 20 Largest Files on the System

sudo find / -type f -exec du -Sh {} + 2>/dev/null | sort -rh | head -n 20

3. Finding Bloated Directories with du

If storage is consumed by thousands of small files (such as session files or cached assets), searching for single large files may not reveal the culprit. Use du (Disk Usage) instead:

Top Directories in the Root Filesystem

sudo du -h --max-depth=1 / 2>/dev/null | sort -hr | head -n 15

Checking Common Space Hogs

Check standard directories that frequently balloon in size:

# System and application logs
sudo du -sh /var/log/* | sort -hr | head -n 10

# Package manager cache
sudo du -sh /var/cache/apt/archives

# Web files and user uploads
sudo du -sh /var/www/* | sort -hr

4. Interactive Disk Exploration with ncdu

For the fastest and easiest disk navigation, install ncdu:

sudo apt install ncdu -y
sudo ncdu /

ncdu gives you an interactive browser. Use arrow keys to navigate directories, press d to delete a selected file/folder, and q to quit.

5. Quick Storage Reclamation Commands

If your server is in an emergency state (0% free space), run these cleanup commands:

1. Clean APT Package Cache

sudo apt clean
sudo apt autoremove --purge -y

2. Vacuum Systemd Journal Logs

# Retain only the last 3 days of systemd journal logs
sudo journalctl --vacuum-time=3d
# Or restrict journal size to 200MB max
sudo journalctl --vacuum-size=200M

3. Clear Rotated Log Archives

sudo find /var/log -type f -name "*.gz" -delete
sudo find /var/log -type f -name "*.1" -delete

Common Mistakes

• Deleting active log files directly without truncating: If you run rm /var/log/nginx/access.log, the Nginx process still holds the open file descriptor in memory, meaning the disk space will NOT be freed until Nginx is restarted. Instead, truncate it: > /var/log/nginx/access.log.
• Scanning /proc and /sys: These are virtual memory filesystems and scanning them wastes time and produces erroneous size calculations.

Troubleshooting

• df shows disk is full, but du shows free space: This happens when a large file was deleted with rm, but a running process is still writing to or holding its file handle. Run sudo lsof +L1 to find deleted files with open handles, then restart the corresponding service.

Best Practices

• Configure logrotate in /etc/logrotate.d/ to automatically compress and purge stale application logs.
• Set up automated monitoring to alert you at 80% disk capacity.

Frequently Asked Questions

Why is my /var/log/journal folder so huge?

By default, systemd journal logs can grow up to 10% of total filesystem size. Configure SystemMaxUse=200M in /etc/systemd/journald.conf to cap it.

How do I check Inode usage?

Run df -i. If inodes are 100% utilized, you cannot create new files even if physical gigabytes remain free.

Conclusion

Regular disk audits and automated log rotation keep your RivinCloud VPS clean, fast, and resilient against storage exhaustion emergencies!