Hunting Down Huge Files on My Linux Box: A First-Person Tale

Posted byneifferhussian

I was mid-coffee when my laptop yelled at me.
No space left on device.
Great. I was just trying to save a report.

I’ve run Linux for years. I still get bit by big files. You know what? It happens fast. Logs grow. Docker grows. Backups hide in odd corners. So I took a breath, and went hunting.
For an extended version of this saga, check out my original write-up, Hunting Down Huge Files on My Linux Box.

The “oh no” moment

I tried to update packages. Boom. Error.
Then Chrome froze. My build failed too. My heart sank a bit.
I had to free space, and quick.

First, I checked disk use. Simple start.

df -h

My root drive was at 100%. Not ideal.

Quick wins that bought me time

I cleaned apt cache. It helped a little.

sudo apt clean

Then I checked my trash. It was huge.
Yep, I forget it too.

gio trash --empty   # or use your file manager UI

That gave me a few gigs. Not enough, though. If you need a crash course on more common cleanup tactics, check out this classic overview of ways to free up disk space on Linux.

If your disk is clogged with massive archives you still need to unpack, take a peek at this hands-on guide to unzipping mountains of files on Linux—it might save you another round of space hunting.

My go-to map: where is the bulk?

I like a clear map. This shows big folders, one level deep. It’s fast and safe.

sudo du -xh --max-depth=1 / | sort -h | tail

That day, my output ended like this:

3.7G /home
4.9G /var/log
12G /var/lib/docker

So, logs and Docker were the monsters. No shock there.

Find the actual big files

Folders are hints. Files tell the truth. This finds files over 1 GB on the root drive, and sorts them.

sudo find / -xdev -type f -size +1G -printf '%10s %pn' 2>/dev/null | sort -nr | head -n 20

My top hits were real:

12884901888 /var/lib/docker/overlay2/.../diff/var/log/app.log
5368709120  /var/log/journal/abcd/system@0005ef12...
4294967296  /home/kayla/Videos/screen-2024-10-15.mkv

That app log? It wasn’t even our app. It was a stale container. Oof.

Logs: the quiet hoarders

Systemd journals can swell. It’s not bad; it’s just chatty.

Check size:

sudo journalctl --disk-usage

Mine said 5.2G. I trimmed it to a week:

sudo journalctl --vacuum-time=7d

Or use a size cap:

sudo journalctl --vacuum-size=500M

That freed gigabytes. Felt like a deep exhale.

Also peeked at /var/log. The one-liners below helped:

sudo du -xh --max-depth=1 /var/log | sort -h | tail

I found a rotated nginx log stuck at 1.8G. Old stuff. I archived it, then removed it.
When ownership quirks stop you from trimming or archiving logs, walk through changing file owners on Linux first, then clean up safely.

Docker: the space thief I forget about

I build stuff a lot. Layers pile up. Old images sit forever.

See what’s eating space:

docker system df

Mine showed this:

Images space usage: 8.2GB
Build cache: 3.4GB
Volumes: 1.1GB

I pruned safely first:

docker image prune
docker builder prune

Then, when I was sure I didn’t need old images, I went stronger:

docker image prune -a
docker builder prune -a

Careful here. Don’t cut what you need. I checked running stuff first:

docker ps -a

That cleared about 9 GB. Big win.

The sneaky case: deleted files still taking space

This one trips folks up. A process keeps a deleted file open. Space stays “used.”

Check for that:

sudo lsof +L1 | grep deleted | head

I once found a Node server holding a 2 GB log that I had already deleted. I restarted the service, and boom, space came back.

ncdu: my favorite space radar

When I want to “see” the mess, I use ncdu. It’s a tiny, fast browser for disk usage. It feels like spelunking, but with arrows.

Install it:

sudo apt install ncdu

Scan root, but keep it to one disk:

sudo ncdu -x /

I love how it lists folders by size. I hit enter to step inside. I hit d to delete when I’m sure. That day, I found a temp build folder at 3.2G in /home/kayla/.cache. Gone in seconds.

Prefer a GUI? Baobab is fine too

On my Ubuntu laptop, I use Disk Usage Analyzer (Baobab). It shows big sunburst charts. It’s not as fast as ncdu, but it’s friendly.
If you want broader rundowns of useful desktop utilities, I’ve found fresh write-ups over on Desktop Linux Reviews. Need more inspiration? Linux.com’s concise roundup of disk usage analysis and cleanup tools is a handy reference.

I ran it, clicked my home folder, and found a huge screen capture video. I moved it to an external drive. Easy.

Sometimes, these visual tools reveal the real storage hogs aren’t system logs or container layers at all—they’re gigantic personal video downloads. If your trek through Baobab or ncdu uncovers a trove of adult clips gobbling up gigabytes and you’re curious just how quickly that sort of library can swell, swing by FuckLocal’s local sluts gallery to see blunt examples of high-resolution media sizes and learn a few practical tips for organizing (or deleting) steamy downloads before they suffocate your drive again. Likewise, if you’re sorting through high-resolution photos from regional personals sites, the image-heavy posts over at Backpage San Benito can pile up fast; browsing them directly through the site lets you decide what’s worth saving and helps you avoid cluttering your newly freed drive space.

A tiny mix-up I had to fix

At first, I blamed photos. I was wrong. It was logs and Docker. Funny thing is, photos did grow last month too. So I made two changes.

  • I set my camera app to save to an SD card.
  • I added log limits in journald.conf.

It felt small. It made a big difference.

Real commands I reach for again and again

  • See the big folders:
    • sudo du -xh –max-depth=1 / | sort -h | tail
  • Find huge files:
    • sudo find / -xdev -type f -size +1G -printf '%10s %pn' 2>/dev/null | sort -nr | head
  • Check journal size and trim:
    • sudo journalctl –disk-usage
    • sudo journalctl –vacuum-time=7d
  • Docker space:
    • docker system df
    • docker image prune
    • docker builder prune
  • Deleted files still open:
    • sudo lsof +L1 | grep deleted
  • Friendly TUI browser:
    • sudo ncdu -x /

A small checklist I now keep on my desk

  • Are logs huge? Check /var/log and journal.
  • Is Docker bloated? Prune images and build cache.
  • Any “deleted but held” files? Use lsof.
  • Any giant folders in home? Look at Downloads, Videos, .cache.
  • Trash emptied? Don’t laugh. It helps.
  • Backups parked on the wrong disk? Move or compress them.
  • Any abandoned symlinks pointing nowhere? Consider deleting symlinks on Linux to tidy them up.

What I liked, and what bugged me

  • I liked how fast ncdu is. It’s clear. It feels calm.
  • find is raw and powerful. It finds the truth.
  • journalctl vacuum tools are safe and simple.

But there are snags.

  • find can print very long paths. It’s hard to read.
  • Docker prune feels scary the first time. I always double-check