Linux Survival Basics
Read-only, can be slowFind the Files Eating Your Disk
A machine is low on disk space and you need to identify the largest files before deleting or rotating anything.
Command
find /var -type f -printf '%s %p\n' | sort -nr | head -20Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Avoid broad searches such as / or /var on very busy or slow storage unless you have considered the I/O impact. Do not run it across network mounts, backups, or database directories just to satisfy curiosity. Do not treat a large file as safe to delete until you know what owns it.
Expected output
A largest-first list of byte sizes and file paths, usually showing logs, caches, uploads, backups, or database files near the top. Read the path and owner context before deleting anything. Broad paths may take time while the command reads directory entries and file sizes.
System impact
Read-only, can be slow. It is read-only: no files are edited or removed. It still walks files and sorts results, so a broad path can create disk I/O; scope to the smallest useful directory first.
May require elevated permissions on protected paths or service-owned files.
Scope this to the smallest useful path or service on busy systems.
When to use it
Use this before deleting logs, caches, backups, uploads, or database dumps. Start with the narrowest path that can answer the question.
When not to use it
Avoid broad searches such as / or /var on very busy or slow storage unless you have considered the I/O impact. Do not run it across network mounts, backups, or database directories just to satisfy curiosity. Do not treat a large file as safe to delete until you know what owns it.
Recovery / rollback
No filesystem state is changed. If the scan creates too much load, stop it with Ctrl-C and rerun against a narrower directory.
Scope the scan before you widen it
The command is read-only, but it can still be expensive. Start where the disk-full evidence points, then widen only if the first path does not explain the pressure.
find /var -xdev -type f -printf '%s %p\n' | sort -nr | head -20find /home -xdev -type f -printf '%s %p\n' | sort -nr | head -20find "$PWD" -xdev -type f -printf '%s %p\n' | sort -nr | head -20
Human-readable variant
Raw bytes sort correctly. When you need to talk through the result with someone else, convert the top rows after sorting.
find /var -xdev -type f -printf '%s %p\n' | sort -nr | head -20 | numfmt --field=1 --to=iec
Common misread
The largest file is not automatically the right file to remove. It may be an active database, a backup target, a current upload, or a log still held open by a running process.
next steps
Related commands
Find Which Folder Is Filling the Disk
The disk was full. The fastest clue was the folder, not the file.
du -sh /var/* 2>/dev/null | sort -h
Show Big Files in Human Units
Byte counts are precise. Human units are faster under pressure.
find /var -type f -printf '%s %p\n' | sort -nr | head -10 | awk '{printf "%.1f MB %s\n", $1/1024/1024, $2}'
Check Filesystem Space with df
A full disk can break logins, uploads, databases, and deploys.
df -h
Check Inodes When Disk Space Looks Fine
Sometimes the disk has free bytes but still cannot create files.
df -ih
next diagnostic step
Where to go from this command
- Linux disk full problem hub Use this when the large-file list is part of a disk-full incident.
- Disk full first-response guide Walk through bytes, inodes, deleted-open files, and cleanup ownership.
- LPIC find-files drill Practice reading size, owner, and mtime fields before acting.
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.