Linux server out of space? How to track files with Ncdu

The panic of full disk space on Linux servers

Working with server infrastructure means dealing sooner or later with the fateful error message indicating that the filesystem is at 100% capacity. In practice, this means applications stop writing logs, databases reject new transactions, and entire systems collapse. The major challenge in production environments is diagnosing the root of the problem swiftly, without wasting time running blind commands that fail to reveal where storage was actually consumed.

When the monitoring alarm goes off, the first reaction of many administrators is to rely on the classic df -h command to check which partitions are exhausted. However, df only shows a macro view of storage, leaving the engineer clueless about which specific directory is inflating out of control. It is precisely in this tight spot that Ncdu (NCurses Disk Usage) comes into play, a lightweight and visual tool that drastically simplifies the scanning of files directly inside the terminal.

Why traditional commands fail under pressure

During a storage crunch, the temptation to use the du command combined with sort and head is high to try listing the largest directories on the system. In practice, this approach consumes heavy processing cycles and yields a static, confusing list that does not allow digging deeper into subdirectories without typing long new commands. Another common tool, the find command, helps locate recently modified files, but requires complex parameters and fails to deliver an intuitive visual perspective of total consumption.

Furthermore, improper use of native tools can mask problems caused by running processes that still hold open references to deleted files. In many emergency scenarios, even before using Ncdu, it is worth checking for lingering residue blocking disk space, something very common in environments requiring complex cleanups such as when pipelines fail due to low disk space and we clean Docker to recover machine headroom without crashing the ecosystem.

Installing and preparing Ncdu for scanning

Ncdu is built on the NCurses library, meaning it draws a lightweight text-based graphical interface directly inside your SSH terminal window. To install it on Debian or Ubuntu-based distributions, simply run the default system package manager with administrative superuser privileges.

sudo apt update && sudo apt install ncdu -y

In Red Hat-based ecosystems like CentOS or AlmaLinux, the process uses the dnf or yum manager equivalently. The resource consumption to install and run the utility is practically negligible, making it safe for immediate use even on servers running under extremely heavy workloads with scarce free memory.

Navigating the visual interface to find storage villains

Once installed, initiating a scan of a specific directory is extremely simple. To analyze the entire filesystem starting from the root, simply invoke the command pointing to the main directory, keeping in mind that a full scan may take a few seconds depending on the speed of the connected disks.

ncdu /var/log

Upon opening the interface, Ncdu neatly lists directories from the largest to the smallest storage consumer, accompanied by intuitive visual bars. You can use your keyboard arrow keys to navigate up and down, press Enter to enter a specific folder and view its detailed internal contents, or press the 'd' key to delete a file or directory directly from the interface after a safety confirmation.

This agile interactivity allows you to quickly isolate gigantic log files, forgotten database dumps, or old build artifacts occupying precious gigabytes. Should you find corrupted files or improperly generated keys compromising environmental security and space, the manual auditing process complements other preventive digital hygiene practices, aligning with security strategies such as when we audit exposed secrets in code with Gitleaks to ensure no sensitive data occupies unnecessary space in the repository.

Best practices to prevent disk space from filling up again

Finding the problem with Ncdu resolves the immediate symptom, but true systems engineering requires preventing the incident from recurring the following week. It is essential to implement log rotation policies using native operating system tools, configure automatic free space alerts through observability platforms, and periodically review temporary directories like /tmp and /var/tmp.

On modern servers dealing with multiple cloud services and continuous data flows, maintaining an automated maintenance routine guarantees operational stability and peace of mind for the technical team. Mastering lean tools like Ncdu turns a potential crisis moment into a fast, controlled surgical procedure, ensuring your Linux server keeps running with high performance and no unwanted surprises.