du command: find out which directory is using the space

Syntax

du [options] [directory]

With no directory it starts from where you are.

Try it first

-h prints readable sizes.

$ du -h
24K	./logs
4.0K	./src
4.0K	./docs
4.0K	./node_modules/left-pad
12K	./node_modules/lodash
20K	./node_modules
56K	.

Totals add up from the bottom, and the last line is the whole directory. For that total alone, add -s.

$ du -sh
56K	.

-s is summarize and -h is human readable. You will almost always type them together.

One level at a time

Plain du walks all the way down, so the insides of node_modules show up too. --max-depth=1 keeps it to a single level.

$ du -h --max-depth=1
24K	./logs
4.0K	./src
4.0K	./docs
20K	./node_modules
56K	.

Now logs is clearly the heavy one. Repeating this inside the heavy directory is the shortest path to the culprit.

$ du -sh logs
24K	logs

Biggest first

When there are many entries, pipe into sort.

$ du -s * | sort -nr
24	logs
20	node_modules
5	src
5	docs
1	README.md

There is a reason -h is missing here. Readable output mixes 4.0K with 12M, and sorting those as numbers puts them in the wrong order. Sort the block counts, then read the winner again with -sh.

Leaving things out

--exclude drops entries from the count.

$ du -h --exclude=node_modules
24K	./logs
4.0K	./src
4.0K	./docs
36K	.

Excluding what you cannot delete anyway, such as node_modules or .git, leaves only what you can act on.

When you actually reach for it

du is what you type to find out what filled the disk.

Things that trip people up

Numbers without a unit are blocks.

$ du -s
56	.

A block is 1KB, so 56 means 56KB. Use -h for numbers people read, and raw blocks for numbers you sort.

A missing path says so.

$ du -sh nope
du: cannot access 'nope': No such file or directory

du walks everything below it. Run it on a huge directory and you wait for the answer. Adding --max-depth=1 and descending level by level finishes far sooner.

du and df can disagree. If a process still holds a deleted file open, the space never returns to df even though du no longer sees the file. When df refuses to drop, suspect a process holding a file open.