Krdytkyu

You can use ncdu for this. It works very well.

sudo apt install ncdu

I use this command

sudo du -aBM -d 1 . | sort -nr | head -20

Occasionally, I need to run it from the / directory, as I've placed something in an odd location.

There are already many good answers about ways to find directories taking most of the space. If you have reason to believe that few large files are the main problem, rather than many small ones, you could use something like find / -size +10M.

I don't know Ubuntu and can't check my answer but post here my answer based on my experience as unix admin long time ago.

1. 
   

   Find out which filesystem runs out of space

   
   
   

   df -h
   
   

   
   
   

   will list all filesystem, their size and their free space. You only waste time if you investigate filesystems that have enough space. Assume that the full filesystem is /myfilesystem. check the df output if there are filesystems mounted on subdirs of /myfilesystems. If so, the following speps must be adapted to this situation.

   
   


2. 
   

   Find out how much space is used by the files of this filesystem

   
   
   

   du -sh /myfilesystem
   
   

   
   
   

   The -x option may be used to guarantee that only the files that are member of this filesystems are taken into account. Some Unix variants (e.g. Solaris) do not know the -x option for du. Then you have to use some workarounds to find the du of your filesystem.

   
   



3. Now check if the du of the visible files is approximately the size of the used space displayed by df. If so, you can start to find the large files/directories of the /myfilesystem filesystem to clean up.



4. 
   

   to find the largest subdirectories of a directory /.../dir use

   
   
   

   du -sk /.../dir/*|sort -n
   
   

   
   
   

   the -k option forces du to output the sie in kilobyte without any unit. This may be the default on some systems. Then you can omit this option. The largest files/subdirectories will be shown at the bottom of the output.

   
   



5. If you have found a large file/directory that you don't need anymore you can remove it in an appropriate way. Don't bother about the small directories on the top of the output. It won't solve your problem if you delete them. If you still haven't enough space than you can repeat step 4 in the larges subdirectories which are displayed at the bottom of the list.

But what happened if the du output is not approximately the available space displayed by df?

If the du output is larger then you have missed a subdirectory where another filesystem is mounted. If the du output is much smaller, then som files are not shown in any directory tha du inspects. There can be different reasons for his phenomena.

6. some processes are using a file that was already deleted. Therefore this files were removed from the directory and du can't see them. But for the filesystem their blocks are still in use until the proceses close the files. You can try to find out the relevant processes (e.g. with lsof) and force them to close this files (e.g by stopping the application or by killing the processes). Or you simply reboot your machine.



7. 
   

   there are files in directories that aren't visible anymore because on one of their parent directories another filesystem is mounted. So if you have a file /myfilesysem/subdir/bigfile and now mount another filesystem on /myfilesystem/subdir then you cannot see this file anymore and

   
   
   

   du -shx /myfilesystem 
   
   

   
   
   

   will report a value that does not contain the size of /myfilesystem/subdir/bigfile. The only way to find out if such files exist is to unmount /myfilesystem/subir and check with

   
   
   

   ls -la /myfilesystem/subdir 
   
   

   
   
   

   if it contains files.

   
   



8. There may be special types of filesystems that use/reserve space on a disk that is not visible to the ls command. You need special tools to display this.

Besides this systematic way using the du command there are some other you can use. So you can use the find command to find files that are larger then some value you supply, you can search for files that larger than some value you supply or that were newly created or have a special name (e.g. *.log, core, *.trc). But you always should do a df as described in 1 so that you work on the right filesystem

In case you are also interested in not using a command, here's an app: Filelight

It lets you quickly visualize what's using disk space in any folder.

Try sudo apt-get autoremove to remove the unused files if you haven't done so

I often use this one

du -sh /*/

Then if I find some big folders I'll switch to it and do further investigation

cd big_dir

du -sh */

If needed you can also make it sort automatically with

du -s /*/ | sort -n

Not really an answer - but an addendum.

You're hard out of space and can't install ncdu from @erman 's answer.

Some suggestions

• 
  sudo apt clean all to delete packages you have already downloaded. SAFE


• 
  sudo rm -f /var/log/*gz purge log files older than a week or two - will not delete newer/current logs. MOSTLY SAFE


• 
  sudo lsof | grep deleted list all open files, but filter down to the ones which have been deleted from disk. FAIRLY SAFE


• 
  sudo rm /tmp/* delete some temp files - if something's using them you could upset a process. NOT REALLY THAT SAFE

That `lsof one may return lines like this:

server456 ~ $ lsof | grep deleted

init          1          root    9r      REG              253,0  10406312       3104 /var/lib/sss/mc/initgro                        ups (deleted)

salt-mini  4532          root    0r      REG              253,0        17     393614 /tmp/sh-thd-1492991421                         (deleted)

Can't do much for the init line, but the second line suggest salt-minion has a file open which was deleted, and the disk blocks will be returned once all the file handles are closed by a service restart.

Other common suspects here would include syslog / rsyslog / syslog-ng, squid, apache, or any process your server runs which is "heavy ".

I find particularly valuable the output of tools like Filelight, but, as in your case, on servers normally there's no GUI installed, but the du command is always available.

What I normally do is:

• write the du output to a file (du / > du_output.txt);


• copy the file on my machine;


• use DuFS to "mount" the du output in a temporary directory; DuFS uses FUSE to create a virtual filesystem (= no files are actually created, it's all fake) according to the du output;


• run Filelight or another GUI tool on this temporary directory.

Disclaimer: I wrote dufs - exactly because I often have to find out what hogs disk space on headless machines.

Similar to @TopHat, but filters some files if they have M, G, or T in the name. I don't believe it will miss size in the first column, but it won't match the filename unless you name files creatively.

du -chad 1 . | grep -E '[0-9]M[[:blank:]]|[0-9]G[[:blank:]]|[0-9]T[[:blank:]]'

Command line switches explained here since I didn't know what the c or a did.