15 September 2026 · One command a day

How do I find what is using disk space on Linux?

The du command adds up how much disk each directory is using. Run it with -sh * and pipe it through sort -h, and you get every folder in the current location listed from smallest to largest. You reach for it the moment df tells you the disk is nearly full and you need to know where the space has gone.

The command

sudo du -sh * | sort -h

du stands for disk usage. The -s flag means summarise, so you get one total per item instead of a line for every subdirectory inside it. The -h flag prints sizes as K, M and G rather than raw block counts. The * is expanded by your shell into every visible file and folder in the current directory, so du measures each one. sudo lets it read directories owned by root and other users. Without it you get permission errors and totals that are too small. The pipe to sort -h sorts by those human-readable sizes, so 900M correctly lands below 2.1G and the biggest item ends up on the last line.

What you will see

user@host:/var$ sudo du -sh * | sort -h
0	lock
0	run
4.0K	local
4.0K	opt
16K	tmp
12M	mail
82M	backups
240M	cache
1.1G	log
3.6G	www
19G	lib

Each line is a size followed by a name. Read from the bottom up. Here lib is the clear winner at 19G, which on a server running Docker usually means images and volumes under /var/lib/docker. Change into the largest directory, run the same command again, and keep drilling down until you reach the actual files. Three or four rounds normally gets you to the culprit.

When to use it

• When df shows the disk above 90% and you need to know which folder is responsible before it hits 100% and services start failing.
• Before a backup or a move to a new server, so you know how big each site or app directory really is.
• When an app is looping on an error and writing to its log every few milliseconds. PM2 logs in a home directory can grow to gigabytes in a night.

Watch out for

The * does not match hidden entries, meaning anything starting with a dot. In a home directory that is exactly where the big things hide: .pm2, .npm, .cache and .docker can each hold gigabytes and will not appear in the list. To include them, run sudo du -sh .[!.]* * | sort -h instead. Also avoid running it directly in /, because it will wander into /proc and print errors. Start in /var, /home or /root, where the real data lives.

Questions people ask

Can I show the largest folders first?

Yes. Add -r to reverse the sort and head to trim the list: sudo du -sh * | sort -rh | head -5 gives you the five biggest items at the top.

Why do the du totals not match what df reports?

df counts the whole filesystem, including files that have been deleted but are still held open by a running process, which du cannot see. If the numbers are far apart, run sudo lsof +L1 to find the process and restart it.

On shared hosting you only ever see your own folder, so the missing space stays a mystery. This is the kind of thing you can only do on a server you control. You can get the same VPS with 20% off at https://asksteves.co.uk/vps. Affiliate link.