No more disk space: How can I find what is taking up the space?

As always in Linux, there's more than one way to get the job done. However, if you need to do it from CLI, this is my preferred method:

I start by running this as root or with sudo:

du -cha --max-depth=1 / | grep -E "M|G"

The grep is to limit the returning lines to those which return with values in the Megabyte or Gigabyte range. If your disks are big enough, you could add |T as well to include Terabyte amounts. You may get some errors on /proc, /sys, and/or /dev since they are not real files on disk. However, it should still provide valid output for the rest of the directories in root. After you find the biggest ones you can then run the command inside of that directory in order to narrow your way down the culprit. So for example, if /var was the biggest you could do it like this next:

du -cha --max-depth=1 /var | grep -E "M|G"

That should lead you to the problem children!

Additional Considerations

While the above command will certainly do the trick, I had some constructive criticism in the comments below that pointed out some things you could also include.

1. The grep I provided could result in the occasional "K" value being returned if the name of the directory or file has a capital G or M. If you absolutely don't want any of the K valued directories showing up you'd want to up your regex game to be more creative and complex. e.g. grep -E "^[0-9\.]*[MG]"

2. If you know which drive is the issue and it has other mounted drives on top of it that you don't want to waste time including in your search, you could add the -x flag to your du command. Man page description of that flag:

     -x, --one-file-system
         skip directories on different file systems
   

3. You can sort the output of the du command so that the highest value is at the bottom. Just append this to the end of the command: | sort -h

You can use ncdu for this. It works very well.

sudo apt install ncdu

I use this command:

sudo du -aBM -d 1 . | sort -nr | head -20

Occasionally, I need to run it from the / directory, as I've placed something in an odd location.

There are already many good answers about ways to find which directories take most of the space. If you have reason to believe that a few large files are the main problem, rather than many small ones, you could use something like:

find / -size +10M

In case you are also interested in not using a command, here's an app: Filelight

It lets you quickly visualize what's using disk space in any folder.

I don't know Ubuntu and can't check my answer but post here my answer based on my experience as unix admin long time ago.

1. Find out which filesystem runs out of space

   df -h
   

   will list all filesystem, their size and their free space. You only waste time if you investigate filesystems that have enough space. Assume that the full filesystem is /myfilesystem. check the df output if there are filesystems mounted on subdirs of /myfilesystems. If so, the following speps must be adapted to this situation.

2. Find out how much space is used by the files of this filesystem

   du -sh /myfilesystem
   

   The -x option may be used to guarantee that only the files that are member of this filesystems are taken into account. Some Unix variants (e.g. Solaris) do not know the -x option for du. Then you have to use some workarounds to find the du of your filesystem.

3. Now check if the du of the visible files is approximately the size of the used space displayed by df. If so, you can start to find the large files/directories of the /myfilesystem filesystem to clean up.

4. to find the largest subdirectories of a directory /.../dir use

   du -sk /.../dir/*|sort -n
   

   the -k option forces du to output the sie in kilobyte without any unit. This may be the default on some systems. Then you can omit this option. The largest files/subdirectories will be shown at the bottom of the output.

5. If you have found a large file/directory that you don't need anymore you can remove it in an appropriate way. Don't bother about the small directories on the top of the output. It won't solve your problem if you delete them. If you still haven't enough space than you can repeat step 4 in the larges subdirectories which are displayed at the bottom of the list.

But what happened if the du output is not approximately the available space displayed by df?

If the du output is larger then you have missed a subdirectory where another filesystem is mounted. If the du output is much smaller, then som files are not shown in any directory tha du inspects. There can be different reasons for his phenomena.

6. some processes are using a file that was already deleted. Therefore this files were removed from the directory and du can't see them. But for the filesystem their blocks are still in use until the proceses close the files. You can try to find out the relevant processes (e.g. with lsof) and force them to close this files (e.g by stopping the application or by killing the processes). Or you simply reboot your machine.

7. there are files in directories that aren't visible anymore because on one of their parent directories another filesystem is mounted. So if you have a file /myfilesysem/subdir/bigfile and now mount another filesystem on /myfilesystem/subdir then you cannot see this file anymore and

   du -shx /myfilesystem 
   

   will report a value that does not contain the size of /myfilesystem/subdir/bigfile. The only way to find out if such files exist is to unmount /myfilesystem/subir and check with

   ls -la /myfilesystem/subdir 
   

   if it contains files.

8. There may be special types of filesystems that use/reserve space on a disk that is not visible to the ls command. You need special tools to display this.

Besides this systematic way using the du command there are some other you can use. So you can use the find command to find files that are larger then some value you supply, you can search for files that larger than some value you supply or that were newly created or have a special name (e.g. *.log, core, *.trc). But you always should do a df as described in 1 so that you work on the right filesystem

I often use this one

du -sh /*/

Then if I find some big folders I'll switch to it and do further investigation

cd big_dir
du -sh */

If needed you can also make it sort automatically with

du -s /*/ | sort -n

Try sudo apt-get autoremove to remove the unused files if you haven't done so

Not really an answer - but an addendum.

You're hard out of space and can't install ncdu from @erman 's answer.

Some suggestions

• sudo apt clean all to delete packages you have already downloaded. SAFE
• sudo rm -f /var/log/*gz purge log files older than a week or two - will not delete newer/current logs. MOSTLY SAFE
• sudo lsof | grep deleted list all open files, but filter down to the ones which have been deleted from disk. FAIRLY SAFE
• sudo rm /tmp/* delete some temp files - if something's using them you could upset a process. NOT REALLY THAT SAFE

That `lsof one may return lines like this:

server456 ~ $ lsof | grep deleted
init          1          root    9r      REG              253,0  10406312       3104 /var/lib/sss/mc/initgro                        ups (deleted)
salt-mini  4532          root    0r      REG              253,0        17     393614 /tmp/sh-thd-1492991421                         (deleted)

Can't do much for the init line, but the second line suggest salt-minion has a file open which was deleted, and the disk blocks will be returned once all the file handles are closed by a service restart.

Other common suspects here would include syslog / rsyslog / syslog-ng, squid, apache, or any process your server runs which is "heavy ".

I find particularly valuable the output of tools like Filelight, but, as in your case, on servers normally there's no GUI installed, but the du command is always available.

What I normally do is:

• write the du output to a file (du / > du_output.txt);
• copy the file on my machine;
• use DuFS to "mount" the du output in a temporary directory; DuFS uses FUSE to create a virtual filesystem (= no files are actually created, it's all fake) according to the du output;
• run Filelight or another GUI tool on this temporary directory.

Disclaimer: I wrote dufs - exactly because I often have to find out what hogs disk space on headless machines.