Linux Survival Basics

Read-only, can be slow

Find the Files Eating Your Disk

A machine is low on disk space and you need to identify the largest files before deleting or rotating anything.

Command

find /var -type f -printf '%s %p\n' | sort -nr | head -20

Before you run this

System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.

When not to use it: Avoid broad searches on very busy or slow disks without considering I/O impact. Do not treat a large file as safe to delete until you know what owns it.

Expected output

A largest-first list of byte sizes and file paths, usually showing logs, caches, uploads, backups, or database files near the top.

System impact

Read-only, can be slow. Nothing changes on disk. The command lists large files so cleanup starts from evidence instead of guesses.

May require elevated permissions on protected paths or service-owned files.

Scope this to the smallest useful path or service on busy systems.

When to use it

Use this before deleting logs, caches, backups, uploads, or database dumps. Start with a narrower path if the server is busy.

When not to use it

Avoid broad searches on very busy or slow disks without considering I/O impact. Do not treat a large file as safe to delete until you know what owns it.

Recovery / rollback

No filesystem state is changed. If the command is too expensive, stop it with Ctrl-C and rerun against a narrower directory.

Explanation-only example

Illustrated output, not a live lab run

This example is intentionally illustrative. It shows the command shape without killing real processes or changing your machine.

demo@lab:~$

$ df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        25G   19G  5G  80% /work
tmpfs            64M     0   64M   0% /dev
shm              64M     0   64M   0% /dev/shm
tmpfs            64M     0   64M   0% /tmp
tmpfs            64M  352K   64M   1% /var
/dev/vda1        25G   19G  5G  80% /work
tmpfs            63G     0   63G   0% /proc/asound
tmpfs            63G     0   63G   0% /proc/acpi
tmpfs            63G     0   63G   0% /proc/scsi
tmpfs            63G     0   63G   0% /sys/firmware
tmpfs            63G     0   63G   0% /sys/devices/virtual/powercap

$ du -sh /var/* 2>/dev/null | sort -h

64K	/var/backups
96K	/var/log
192K	/var/cache

$ find /var -type f -printf '%s %p\n' | sort -nr | head -20

196608 /var/cache/lab/blob.cache
98304 /var/log/app.log
65536 /var/backups/site.tar

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

df -h
du -sh /var/* 2>/dev/null | sort -h
find /var -type f -printf '%s %p\n' | sort -nr | head -20

next steps

Related commands

Linux Survival Basics Can be slow

Show Big Files in Human Units

Byte counts are precise. Human units are faster under pressure.

find /var -type f -printf '%s %p\n' | sort -nr | head -10 | awk '{printf "%.1f MB %s\n", $1/1024/1024, $2}'

Linux Survival Basics Can be slow

Find Which Folder Is Filling the Disk

The disk was full. The fastest clue was the folder, not the file.

du -sh /var/* 2>/dev/null | sort -h

Web Server Rescue Can be slow

Find Large Directories with du

Once you know a filesystem is full, the next question is where.

du -xh --max-depth=1 /var 2>/dev/null | sort -h

Hosting Operations Can be slow

Rank Old Cleanup Candidates by Size

The oldest file is not always the file that buys back meaningful space.

find /lab/disk-inode-cleanup/var -xdev -type f -mtime +7 -printf '%s %TY-%Tm-%Td %p\n' | sort -nr | head

Hosting Operations Read-only

Check Inodes When Disk Space Looks Fine

Sometimes the disk has free bytes but still cannot create files.

df -ih

Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.