du system

The du man page is 350 lines long. You need two flags and you’ll find whatever is eating your disk space in about five seconds.

Your disk is full. df told you which filesystem is full. Now you need to know what’s filling it. Which directory? Which files? Where are the 200GB of stuff you swore you didn’t put there?

So you opened your file manager. You right-clicked a folder. You clicked “Properties.” You waited while it “calculated” the folder size. It showed you a number. You went up one level. You right-clicked another folder. You waited again. You repeated this twelve times, manually comparing numbers in your head, slowly narrowing down which folder was the biggest. This process took fifteen minutes. You found the problem. It was a single log file.

du shows you directory sizes. One command. Sort the output and the biggest directories are on top. No right-clicking. No calculating. No comparing numbers in your head.

Unless you’re running Windows then wtf none of this applies to you. But hey, come to the dark side, go install WSL2 and you can follow along. We’ll wait. Impatiently.

If you’re lazy like me (all sysadmins are!) then click here for the du cheat sheet.

Check a directory’s total size

du -sh /var/log

4.7G    /var/log

One number. Total size. Human-readable. -s for summary (don’t list every subdirectory), -h for human-readable (GB/MB instead of raw bytes).

Find the biggest subdirectories

du -sh /var/log/* | sort -rh | head -10

2.1G    /var/log/journal
1.8G    /var/log/nginx
412M    /var/log/syslog.1
198M    /var/log/auth.log.1
47M     /var/log/kern.log
23M     /var/log/syslog
8.5M    /var/log/dpkg.log
2.1M    /var/log/alternatives.log
1.4M    /var/log/apt
880K    /var/log/installer

There it is. journal and nginx are eating 4GB. The sort -rh sorts by human-readable size, largest first. head -10 shows the top 10.

This is the command. This is what you came here for. Memorize it or alias it.

Drill down level by level

du -sh /var/* | sort -rh | head -10

Start broad. Find the biggest directory under /var. Then:

du -sh /var/log/* | sort -rh | head -10

Drill into that. Then:

du -sh /var/log/nginx/* | sort -rh | head -10

Deeper. Each command takes seconds. In three commands, you’ve gone from “something in /var is big” to “access.log.3 is 900MB.”

Limit depth

du -h --max-depth=1 /home/owner/

Shows sizes of immediate subdirectories only — doesn’t recurse into sub-subdirectories. Cleaner output when a directory has many nested folders.

du -h -d 1 /home/owner/

Same thing. -d 1 is the short form of --max-depth=1.

Check the current directory

du -sh .

Total size of wherever you are right now.

du -sh */ | sort -rh

Biggest subdirectories of the current directory. Quick and dirty disk inventory.

Find big files (not directories)

du measures directories. To find individual large files:

find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null

Every file over 100MB. The find command locates them, ls -lh shows their sizes. 2>/dev/null suppresses permission errors.

find /home -type f -size +500M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh

Files over 500MB, sorted by size. Your forgotten VM images and database dumps are about to be discovered.

Exclude directories

du -sh --exclude='node_modules' --exclude='.git' /home/owner/projects/*  | sort -rh

Skip node_modules and .git — because they’re huge, they’re everywhere, and they’re not what’s eating your disk space (usually). You already know they’re big. You don’t need du to tell you that.

du vs df

People confuse these constantly. They’re different tools for different questions:

df looks at filesystems (the containers). du looks at directories and files (the contents). Use df to find the problem filesystem, then du to find the problem directory.

Make it an alias

alias ducks='du -cks * | sort -rn | head -20'
alias dush='du -sh * | sort -rh | head -20'

Add these to your .bashrc. Now dush shows you the top 20 biggest things in any directory. One word. Done.

The flags that actually matter

“But I use—”

You don’t need to.

“WinDirTree / TreeSize shows me a treemap.” TreeSize downloads at 15MB, scans your drive with a progress bar, and builds a visual treemap that looks impressive in screenshots. du -sh * | sort -rh gives you the same information in one second. Without the treemap. Because you don’t need a treemap. You need the biggest directory. It’s the first line.

“Disk Inventory X has a visual layout.” It’s a macOS app that shows disk usage as colored rectangles. It takes thirty seconds to scan and renders an interface that’s fun to look at and hard to read. The biggest rectangle is the biggest directory. du would have told you that thirty seconds ago, in text, with the exact path.

“ncdu is better than du.” ncdu is actually great — it’s an interactive, ncurses-based disk usage browser. Navigate in and out of directories, sort, delete files. If it’s installed, use it. If it’s not installed, du -sh * | sort -rh does 90% of what ncdu does with zero installation.

“I just buy more disk space.” Spoken like someone with a cloud budget. Eventually you’ll have a server that can’t be expanded, or a cost report that makes someone ask “why are we paying for 2TB when 90% of it is unrotated logs?” du answers that question.

du cheat sheet

You made it. Or you skipped straight here. Either way, no judgment. Copy and paste these. Pin them. Tattoo them on your forearm. Whatever works.

The one command: du -sh * | sort -rh | head -10 — top 10 biggest things in the current directory. Run it, find the hog, drill down. Repeat.

Back to the top, you overachiever.