I've run into a problem on one of my servers running 16.04: there is no disk space left.
I have no idea what is taking up the space. Is there a command to list the current directory sizes, so I can traverse and end up in the directory taking up all the space?
As always in Linux, there's more than one way to get the job done. However, if you need to do it from CLI, this is my preferred method:
I start by running this as root or with sudo:
du -cha --max-depth=1 / | grep -E "M|G"
The grep is to limit the returning lines to those which return with values in the Megabyte or Gigabyte range. If your disks are big enough, you could add |T as well to include Terabyte amounts. You may get some errors on /proc, /sys, and/or /dev since they are not real files on disk. However, it should still provide valid output for the rest of the directories in root. After you find the biggest ones you can then run the command inside of that directory in order to narrow your way down the culprit. So for example, if /var was the biggest you could do it like this next:
du -cha --max-depth=1 /var | grep -E "M|G"
That should lead you to the problem children!
Additional Considerations
While the above command will certainly do the trick, I had some constructive criticism in the comments below that pointed out some things you could also include.
grep I provided could result in the occasional "K" value being returned if the name of the directory or file has a capital G or M. If you absolutely don't want any of the K valued directories showing up you'd want to up your regex game to be more creative and complex. e.g. grep -E "^[0-9\.]*[MG]"If you know which drive is the issue and it has other mounted drives on top of it that you don't want to waste time including in your search, you could add the -x flag to your du command. Man page description of that flag:
-x, --one-file-system
skip directories on different file systems
You can sort the output of the du command so that the highest value is at the bottom. Just append this to the end of the command: | sort -h
"^[0-9]*[.]*[0-9]*[MG]"
– Xen2050
May 05 '17 at 06:24
-x option to make du stay on that one drive (provided on the command-line). You can also pipe through sort -h to correctly sort the megabyte/gigabyte human-readable values. I would usually leave off the --max-depth option and just search the entire drive this way, sorting appropriately to get the biggest things at the bottom.
– Muzer
May 05 '17 at 12:58
-x? for this? Just give the mount point of the drive as the argument to du.
– alexis
May 05 '17 at 13:20
/), and using -x gives me a guarantee I won't be miscounting things. If your / is full and you have a separately-mounted /home or whatever, using -x is pretty much a necessity to get rid of the irrelevant stuff. So I find it's just easier to use it all the time, just in case.
– Muzer
May 05 '17 at 13:22
--max-depth I'm not sure I'm totally on-board yet. You force yourself to wait on the system to count disk usage for every directory on the entire system. That's a lot of extra overhead when you could just see for yourself which directory to traverse in a single max-depth and not have to dig down any of the other directories.
– TopHat
May 05 '17 at 15:23
du to bother to display it. The only way to calculate it is to add up the sizes for every file and subdirectory, and the only way to calculate those is to add up those sizes, etc.
– Muzer
May 05 '17 at 16:06
sort -hr it will give you the larger results first, if you like that better. I also do the sort first and then the grep so it still highlights the "G" or the "M".
– JohnRDOrazio
Apr 05 '20 at 06:39
You can use ncdu for this. It works very well.
sudo apt install ncdu
curl http://path/to/ncdu | sh , and it will run in an in-memory IO stdin cache, but that'll require some luck. there's probably a way to make a ram-disk too
– hanshenrik
May 04 '17 at 20:09
sudo ncdu / from the command line. sudo because if you dont put sudo, it wont report sizes for folders owned by root, and / because if you dont type that it will only report recusively down from the folder you're in
– Max Carroll
Sep 18 '19 at 08:38
ncdu supports a -x flag which you'll probably want to pass in order to exclude other mounted filesystems under /.
– dimo414
Aug 22 '23 at 22:33
I use this command:
sudo du -aBM -d 1 . | sort -nr | head -20
Occasionally, I need to run it from the / directory, as I've placed something in an odd location.
-d 1 switch (and usually with less instead of head -20), so that I get a complete recursively enumerated list of all files and directories sorted by the space they consume. That way, if I see a directory taking up a lot of space, I can just scroll down to see if most of the space is actually taken up by some specific file or subdirectory in it. It's a good way to find some unneeded files and directories to delete to free some space: just scroll down until you see something you're sure you don't want to keep, delete it and repeat.
– Ilmari Karonen
May 05 '17 at 19:16
sort waits for the output to be completed before beginning output.
– muru
May 29 '17 at 05:34
There are already many good answers about ways to find which directories take most of the space. If you have reason to believe that a few large files are the main problem, rather than many small ones, you could use something like:
find / -size +10M
In case you are also interested in not using a command, here's an app: Filelight
It lets you quickly visualize what's using disk space in any folder.
ssh -X <your host> and then run your program from the command line
–
Jun 05 '17 at 11:30
I don't know Ubuntu and can't check my answer but post here my answer based on my experience as unix admin long time ago.
Find out which filesystem runs out of space
df -h
will list all filesystem, their size and their free space. You only waste time if you investigate filesystems that have enough space. Assume that the full filesystem is /myfilesystem. check the df output if there are filesystems mounted on subdirs of /myfilesystems. If so, the following speps must be adapted to this situation.
Find out how much space is used by the files of this filesystem
du -sh /myfilesystem
The -x option may be used to guarantee that only the files that are member of this filesystems are taken into account. Some Unix variants (e.g. Solaris) do not know the -x option for du. Then you have to use some workarounds to find the du of your filesystem.
Now check if the du of the visible files is approximately the size of the used space displayed by df. If so, you can start to find the large files/directories of the /myfilesystem filesystem to clean up.
to find the largest subdirectories of a directory /.../dir use
du -sk /.../dir/*|sort -n
the -k option forces du to output the sie in kilobyte without any unit. This may be the default on some systems. Then you can omit this option. The largest files/subdirectories will be shown at the bottom of the output.
If you have found a large file/directory that you don't need anymore you can remove it in an appropriate way. Don't bother about the small directories on the top of the output. It won't solve your problem if you delete them. If you still haven't enough space than you can repeat step 4 in the larges subdirectories which are displayed at the bottom of the list.
But what happened if the du output is not approximately the available space displayed by df?
If the du output is larger then you have missed a subdirectory where another filesystem is mounted. If the du output is much smaller, then som files are not shown in any directory tha du inspects. There can be different reasons for his phenomena.
some processes are using a file that was already deleted. Therefore this files were removed from the directory and du can't see them. But for the filesystem their blocks are still in use until the proceses close the files. You can try to find out the relevant processes (e.g. with lsof) and force them to close this files (e.g by stopping the application or by killing the processes). Or you simply reboot your machine.
there are files in directories that aren't visible anymore because on one of their parent directories another filesystem is mounted. So if you have a file /myfilesysem/subdir/bigfile and now mount another filesystem on /myfilesystem/subdir then you cannot see this file anymore and
du -shx /myfilesystem
will report a value that does not contain the size of /myfilesystem/subdir/bigfile. The only way to find out if such files exist is to unmount /myfilesystem/subir and check with
ls -la /myfilesystem/subdir
if it contains files.
There may be special types of filesystems that use/reserve space on a disk that is not visible to the ls command. You need special tools to display this.
Besides this systematic way using the du command there are some other you can use. So you can use the find command to find files that are larger then some value you supply, you can search for files that larger than some value you supply or that were newly created or have a special name (e.g. *.log, core, *.trc). But you always should do a df as described in 1 so that you work on the right filesystem
/tmp on a separate file system (e. g. a tmpfs) and something created files in /tmp before it became a mount point to a different file system. Now these files are sitting in the root file system, shadowed by a mount point and you can't access them without a reboot to recovery mode (which doesn't process /etc/fstab) or, like you suggest, a bind-mount.
– David Foerster
Jun 03 '17 at 16:58
I often use this one
du -sh /*/
Then if I find some big folders I'll switch to it and do further investigation
cd big_dir
du -sh */
If needed you can also make it sort automatically with
du -s /*/ | sort -n
Try sudo apt-get autoremove to remove the unused files if you haven't done so
Not really an answer - but an addendum.
You're hard out of space and can't install ncdu from @erman 's answer.
Some suggestions
sudo apt clean all to delete packages you have already downloaded. SAFEsudo rm -f /var/log/*gz purge log files older than a week or two - will not delete newer/current logs. MOSTLY SAFEsudo lsof | grep deleted list all open files, but filter down to the ones which have been deleted from disk. FAIRLY SAFEsudo rm /tmp/* delete some temp files - if something's using them you could upset a process. NOT REALLY THAT SAFEThat `lsof one may return lines like this:
server456 ~ $ lsof | grep deleted
init 1 root 9r REG 253,0 10406312 3104 /var/lib/sss/mc/initgro ups (deleted)
salt-mini 4532 root 0r REG 253,0 17 393614 /tmp/sh-thd-1492991421 (deleted)
Can't do much for the init line, but the second line suggest salt-minion has a file open which was deleted, and the disk blocks will be returned once all the file handles are closed by a service restart.
Other common suspects here would include syslog / rsyslog / syslog-ng, squid, apache, or any process your server runs which is "heavy ".
I find particularly valuable the output of tools like Filelight, but, as in your case, on servers normally there's no GUI installed, but the du command is always available.
What I normally do is:
du output to a file (du / > du_output.txt);DuFS to "mount" the du output in a temporary directory; DuFS uses FUSE to create a virtual filesystem (= no files are actually created, it's all fake) according to the du output;Disclaimer: I wrote dufs - exactly because I often have to find out what hogs disk space on headless machines.
For myself it is important to remove the directory /mnt from the calculations (and save time too). Because my /mnt contains other partitions without exclusion the result is:
$time sudo du -cha --max-depth=1 /
(... SNIP ...)
du: cannot access '/proc/27561/fd/3': No such file or directory
du: cannot access '/proc/27561/fdinfo/3': No such file or directory
270G /
270G total
real 2m21.540s
With /mnt exclusion and suppressing error messages:
$time sudo du -cha --max-depth=1 --exclude=/mnt / 2>/dev/null
(... SNIP ...)
13M /sbin
1.8M /run
26G /
26G total
real 0m25.019s
2>/dev/null sends error messages to the bit-bucket./ total of 26 GB is now displayed./media or /run/user/1000 directories.
Go to the folder you want to check, and use:
for i in `echo *`; do echo $i && du -sh $i; done;,
the command prints the file name and the size it takes on the disk in a readable format.
If you want to check folders only, replace 'echo *' with 'echo */'.
No programs needed, just find to search for files bigger than 50M and sort them by size.
find / -size +50M -type f -exec du -h {} ; | sort -h
Similar to @TopHat, but filters some files if they have M, G, or T in the name. I don't believe it will miss size in the first column, but it won't match the filename unless you name files creatively.
du -chad 1 . | grep -E '[0-9]M[[:blank:]]|[0-9]G[[:blank:]]|[0-9]T[[:blank:]]'
Command line switches explained here since I didn't know what the c or a did.
export DISPLAY=:0.0; ssh -Y <user>@<server> filelight(replacefilelightwith your preferred tool). Of course with absolutely no space left, if you don't already have the tool installed you'll need to use something else anyway! – David Spillett May 05 '17 at 10:15du -sh * | sort -h– Dnyaneshwar Harer Jun 18 '19 at 11:53