Guides

Step-by-step tutorials and practical fixes for servers, systems, email, and daily technical work.
Linux Guides

How to Find Large Files on Linux

Locate large files safely with practical commands and a real troubleshooting workflow.

Before you start

You need shell access to the Linux server.
It is better to identify the full filesystem first before scanning for files everywhere.
Do not delete large files until you confirm whether they are logs, backups, uploads, database files, or active application data.

Step-by-step instructions

1. Identify the full filesystem or suspect path first

Before hunting for individual files, confirm which filesystem is actually under pressure. Otherwise you may spend time searching the wrong mount point.

Command 
df -h
Why this matters

If /var, /home, or another mounted filesystem is the one filling up, you should search inside that path first instead of scanning the whole server blindly.

2. Search for files larger than a useful threshold

Use find with a size filter to quickly locate files above a chosen threshold. Start with something meaningful such as 100M or 500M depending on the server.

Command 
find /var -type f -size +100M 2>/dev/null
Practical tip

Start with a narrow path like /var or /home when possible. This is usually faster and produces more useful results than searching from root immediately.

3. Sort large files by actual size

The raw find output is useful, but sorting by size makes it much easier to see the worst offenders first.

Command 
find /var -type f -exec du -h {} + 2>/dev/null | sort -h
What this gives you

This combines file discovery with readable size output and sorts the results from smallest to largest. The largest items will appear at the bottom, which is often the fastest way to spot trouble.

4. Check common heavy file areas

Real servers usually grow in a few predictable places. Logs, backups, user uploads, cache files, temporary directories, and exported reports are common sources of large files.

Examples 
find /var/log -type f -size +100M 2>/dev/null
find /home -type f -size +500M 2>/dev/null
find /tmp -type f -size +100M 2>/dev/null
Why targeted checks help

Targeted searches reduce noise and make it easier to understand whether the issue is operational data, user data, temporary files, or application output.

5. Verify file purpose before cleanup

Once you identify a large file, inspect it carefully. You need to know whether it is safe to delete, whether it should be rotated, or whether it indicates a deeper operational problem.

Command 
ls -alh /var/log
Important check

A very large file is often a symptom, not just clutter. It may point to broken log rotation, runaway exports, backup retention issues, or an application writing more data than expected.

Real example

A server shows high usage on /var. You run find /var -type f -size +500M and discover a single rotated application log that has grown far beyond the expected size. After checking the file and its service context, you confirm that log rotation failed and the file kept growing for days.

This is the correct pattern: identify the full filesystem, find unusually large files inside the relevant path, confirm the file purpose, then apply the correct cleanup or retention fix.

Possible causes

  • Application log files growing without rotation
  • Large backup archives left on the local server
  • User uploads or generated media files accumulating over time
  • Temporary export files or reports not being removed
  • Cache or session files growing unexpectedly
  • Database dump files stored in operational paths

Common mistakes

  • Searching the whole server first instead of narrowing to the full filesystem
  • Using only find without checking directory growth patterns
  • Deleting files before understanding whether they are active operational data
  • Ignoring permission errors and assuming the scan was complete
  • Focusing only on one large file while missing the broader retention or rotation issue

Environment tips

  • Use find ... -size +100M or a higher threshold depending on server scale.
  • Combine find with du and sort -h when you need ordered results.
  • On busy servers, check /var/log, backup paths, upload directories, and temporary file areas first.
  • When a large file is a log, the correct action may be rotation or truncation, not deletion without confirmation.