ncdu Disk Usage: Find What’s Eating Your Linux Drive

A full disk rarely announces itself politely. One minute everything is fine, the next your package manager refuses to run and the desktop is complaining about low space. My earlier guide on how to free up disk space on Linux covers the usual quick wins; this post is about the step before that – working out what is actually eating the space, interactively, so you can make decisions rather than guesses.

This is part one of a short series on Linux housekeeping and the command line.

Start with df: which filesystem is full?

Before digging into directories, confirm which mount is in trouble. df -h shows each filesystem in human-readable units:

df -h
df -h /home

If a filesystem shows free space but you still get "No space left on device", check inodes with df -i. Millions of tiny files (cache directories, mail spools, build artefacts) can exhaust inodes long before bytes run out.

The quick du and sort one-liner

For a fast, non-interactive overview of one level of a directory tree, du piped into sort is hard to beat:

sudo du -xh --max-depth=1 / 2>/dev/null | sort -rh | head -n 15

• -x stays on one filesystem, so it won’t wander into other mounts like /proc or a network share.
• -h prints sizes as K, M and G, and sort -rh sorts those human-readable sizes largest first.
• 2>/dev/null hides the permission-denied noise.

If you want a list of the biggest individual files rather than directories, I’ve covered that separately in finding the ten biggest files or directories.

ncdu: interactive disk usage you can act on

The problem with du is that every drill-down means another command. ncdu (NCurses Disk Usage) scans once, then lets you browse the results with the arrow keys, sorted by size. For ncdu disk usage analysis on a busy machine it’s the tool I reach for first.

Install it

# Debian, Ubuntu, Mint
sudo apt install ncdu

# Fedora
sudo dnf install ncdu

# Arch
sudo pacman -S ncdu

Scan a filesystem

# Scan your home directory
ncdu ~

# Scan the root filesystem without crossing into other mounts
sudo ncdu -x /

Running as root with sudo matters for system paths, otherwise directories you can’t read are skipped and the totals come out low.

Keys worth knowing

• Arrow keys / Enter – move and open a directory; left arrow goes back up.
• s and n – sort by size or by name.
• g – cycle the percentage/graph display.
• i – show details about the selected item.
• d – delete the selected file or directory (ncdu asks for confirmation).
• ? – full help; q quits.

Warning: the d key deletes permanently – there is no recycle bin. Be especially careful when running ncdu as root against /: deleting something under /usr, /var/lib or /boot can break your system. Only delete things you recognise, such as old downloads, ISO images, VM disks or project build folders.

Scan once, browse later

On a large server, scanning can take a while. ncdu can export a scan to a file and load it later, which is handy for scanning a remote box and reviewing the results without rescanning:

sudo ncdu -x -o /tmp/root-scan.ncdu /
ncdu -f /tmp/root-scan.ncdu

When browsing an imported file, you’re looking at a snapshot, so deletions are not available – use it to decide, then clean up for real.

What you’ll usually find

• /var/log/journal – systemd journal logs, covered in cleaning up journalctl logs safely.
• /var/cache/apt, /var/cache/pacman/pkg or /var/lib/snapd – package caches and old snap revisions, covered in clearing package caches on Linux.
• ~/.cache – browser and application caches. Generally safe to clear while the apps are closed.
• ~/.local/share/Trash – files you "deleted" in the file manager but never emptied.
• Docker images, VM disk images and old ISOs – often the single biggest culprits on a developer machine.

Troubleshooting

• df says full, du says otherwise: a process may still hold a deleted file open. Check with sudo lsof +L1 and restart the offending service to release the space.
• Totals look too small: you probably ran ncdu without sudo, or -x excluded a separate /home partition. Scan that mount point directly.
• ncdu not in your repos: on minimal or enterprise installs it may live in an extra repository (EPEL on RHEL-family systems). The du and sort one-liner above works everywhere in the meantime.
• Hunting for the command you ran last week: my Bash/Zsh command history hacks post shows how to search history properly.

Once you know where the space went, the fix is usually obvious – and next time, a two-minute ncdu scan will tell you before the disk fills up again.