ncdu: Interactive Disk Usage Analyzer
What you'll be able to do
- Launch `ncdu` and reach the largest directories with the arrow keys alone
- Explain the `s`, `n`, and `C` sort toggles and the `d` deletion flow
- Choose between `-r` (read-only) and `-x` (one filesystem only)
Prerequisites (read these first)
What You'll Learn
- How to use
ncduto navigate large directories interactively - How to find big files and delete them safely on the spot
- How to switch from hammering
duto a keystroke-only investigation - How to scan a remote server's disk over
ssh
Target Audience: Linux beginners. Anyone tired of chasing space with du.
Words used in this article
- Interactive: a style where you keep working from one screen with key presses, instead of retyping commands.
- DirectoryA container that organizes files. Same idea as a "folder" on Windows or macOS.: the same thing Windows and macOS call a folder.
- Scan: visiting the target files one by one to measure them. Also called "walking" the tree.
- Filesystem: the structure that divides a disk for use. Read it as "a unit such as
/or/homewhose space is counted on its own". - Mount: attaching a disk to a directory so you can use it.
- Standard output / standard input: where a command writes its result, and the opening through which a command receives input. Section 7 uses both.
ncdu can also be used purely for inspection. Launch it with -r and the delete function is disabled outright. Always start your practice with -r.
Note that ncdu is not part of the virtual terminalAn interactive program that reads the commands you type and runs them. on this site. Try it on a real Linux machine or WSL. That is exactly why you should begin with -r.
Introduction: Lina's "du Spam" Incident
du.du, cd deeper, run du again, cd again. This is taking forever.ncdu that does all of it with just the arrow keys.cd, no du?ncdu lets you walk around the screen like a file manager. You drill into the biggest directories and can even delete them right there.The Short Answer
ncdu= NCurses Disk Usage. A tool that showsduresults in an interactive screen- Move with arrow keys, delete in place with
d, sort by size withs - Just install it with
sudo apt install ncduand launchncdu /
1. What Is ncdu?
Conclusion:
ncdushowsduresults in a full-screen interactive view, so you can drill into the biggest paths with arrow keys.
ncdu stand for?ncdu uses that library to display du-style results on screen.du?du just prints numbers.ncdu sorts them biggest first. You press Enter to go in and the left arrow to come back. That is how you reach the space hog without getting lost.ncdu vs du (in a nutshell)
du→ run the command once and get a list of numbers. Then youcdand re-run it yourselfncdu→ scan once, then just walk around the screen to drill down
2. Install and Launch
Conclusion:
ncduis often not installed by default. Install it viaapt/dnf, then launch withncdu PATH.
ncdu on every distribution. Let's start with the install.Install
# Ubuntu / Debian family $ sudo apt install ncdu # RHEL / Fedora family $ sudo dnf install ncdu # Older CentOS, etc. $ sudo yum install ncdu
Launch It
# Scan the current directory $ ncdu # Scan a specific path $ ncdu /var # Scan the whole root (sudo recommended) $ sudo ncdu /
ncdu / and it showed "Scanning..." and made me wait.ncdu scans everything under the given pathA string that describes the location of a file or directory. once.du, a large target takes a moment. When the scan finishes, it switches to the list view.Use sudo for System-Wide Scans
Under / there are directories a normal user cannot read. Without sudo, those parts fail with "PermissionThe read / write / execute access rules set on a file or directory. denied" and go uncounted. The totals then come out smaller than reality.
For system investigation, sudo ncdu / is the baseline.
3. Reading the Screen and Moving Around
Conclusion: Up/down arrows select an item, Enter (or right arrow) enters a directory, left arrow goes back up, and
qquits.
--- /var ------------------------------------------------------
1.2 GiB [##########] /log
512.0 MiB [#### ] /cache
24.0 MiB [ ] /lib
4.0 KiB [ ] /games
How to Read It
- The number on the left: the usage of that directory or file
[#### ]: a bar showing its share of the parent- The
/before a name: the mark for a directory - The top
--- /var ---: where you currently are
Core Key Bindings
Movement Keys (learn just these first)
| Key | Action |
|---|---|
↑ / ↓ |
Select an item (move up/down) |
Enter or → |
Enter the selected directory |
← |
Go back up to the parent |
r |
Rescan the current location |
q |
Quit ncdu |
? |
Show help (key list) |
The r key inside the screen and the -r launch option are different things. The r key rescans. The -r option disables deletion.
cd and no du, just arrow keys to dive into the biggest directory. That is what makes ncdu pleasant.4. Sorting and Display Toggles
Conclusion:
ssorts by size,nby name,Cby item count, andgtoggles the percentage/graph display.
Sort and Display Keys
| Key | Action |
|---|---|
s |
Sort by size (default) |
n |
Sort by name |
C |
Sort by item count (capital C) |
g |
Toggle the percentage / graph bar display |
a |
Toggle apparent size vs. actual disk usage |
When to Use a (apparent size)
By default ncdu shows the size actually occupied on disk. Press a to switch to the file's apparent size.
The two diverge for sparse files and for large numbers of tiny files. Knowing the difference saves confusion.
5. Deleting on the Spot
Conclusion: Select an item and press
d. A confirmation promptA symbol (like $ or #) shown when the shell is waiting for your input. appears, so you skip the round trip of finding withduand removing withrm.
ncdu and run rm to delete it?ncdu, select the item you want gone and press d.du, remove with rm" round trip disappears.Deletion Steps
- Select the file or directory with
↑/↓ - Press
d - A confirmation screen appears. The choices are
yes,no, anddon't ask me again - Move between them with
←/→and confirm withEnter. Pressqto abort
Do not pick the third choice, don't ask me again
Choosing don't ask me again stops the confirmation screen from appearing for later deletions. From then on, pressing d deletes immediately.
While you are learning, use only yes and no.
d Is a Real Delete. There's No Undo
ncdu's d removes the data just like rm. Unlike a GUI, nothing goes to a trash can. You cannot bring it back easily.
Take extra care under sudo ncdu /. Removing a system file by mistake can leave the machine unbootable.
Remember three habits that keep practice safe.
- Launch with
-rfirst (ncdu -r ~). That disables the delete feature outright - Create a practice directory and work only inside it (for example,
mkdir -p ~/ncdu-practice && cd ~/ncdu-practice) - Confirm the name, size, and timestamp before you delete anything
If you are unsure about a directory, do not delete it.
Pre-Delete Checklist
- Is the file truly unneeded (a log, a cache, or a temp file)?
- Is a running service using it?
- For large logs, emptying the file in place is sometimes safer than deleting it (
truncate -s 0 logfile)
One note on the second point. Deleting a file a service still has open does not return the space. For that open-file problem, see Understanding du vs df.
6. Options That Matter in Practice
Conclusion:
-xstays within one filesystem,-ris read-only, and-o/-fexport and reuse a scan.
Common Launch Options
| Option | Meaning |
|---|---|
-x |
Count only the same filesystem (don't cross mounts) |
-r |
Launch in read-only mode (disables d deletion) |
-o FILE |
Export the scan result to a file |
-f FILE |
Import an exported result and display it |
--exclude PATTERN |
Exclude matching paths from the count |
-x the one that came up with du?du -x./home is a separate partition, it keeps you from double-counting across the boundary. That helps when you want to compare against df.6-1. Lina Gets Stuck: d Almost Removed the Wrong Row
/var and wanted to clear a big cache. I pressed d, and the name in the confirmation prompt was not the one I expected. That was a scare.--- /var ------------------------------------------------------
1.2 GiB [##########] /log
512.0 MiB [#### ] /cache
24.0 MiB [ ] /lib
/cache. The prompt said /log. My cursor was one row higher.ncdu, d acts on the row that is currently selected. Where the cursor sits decides everything.-r. The d key does nothing at all, which makes it ideal for practice.Enter.# Practise in a state where deletion cannot happen $ ncdu -r ~
Use -r When Safety Comes First
To prevent an accidental d keystroke, launch with sudo ncdu -r /. With -r the delete feature is disabled.
That makes it investigation-only, which is what you want when you are just looking at a production server.
7. Scanning a Remote Server's Disk
Conclusion: Open a remote scan result in your local
ncduso you can investigate without operating interactively on the server (the remote side still needsncdu).
ncdu can export and import scan results.ssh, that lets you investigate from your own screen.Pattern A: Scan Remotely, View Locally
# Run only the du-style scan remotely and pipe the result into your local ncdu $ ssh user@server ncdu -o- / | ncdu -f-
How to Read It
ncdu -o-: writes the scan result to standard output (-means stdout)ncdu -f-: reads the result from standard input and displays it- The
|between them: pipes the remote output into your localncdu
One caveat. Running -o still requires ncdu on the remote side. If it is not installed there, install it on the remote machine first.
Pattern B: Save the Result and Carry It Home
Instead of streaming it straight through, you save the result to a file first. A saved result can be reviewed later.
# On the server, save the result (gzip keeps it small) $ ncdu -o- / | gzip > scan.gz # Transfer and load it locally $ scp user@server:scan.gz . $ zcat scan.gz | ncdu -f-
8. Mini Exercises: Try It on Your Box
Conclusion: Three drills — find your largest home directory, toggle sort modes, and launch read-only — to lock in the controls.
-r on, no deletion can happen.Exercise 1: Find the largest directory directly under your home.
Show Hint 1 (Direction)
Launch it with the place you want to inspect. The list is sorted biggest first by default.
So the top row already answers the question.
Show Hint 2 (Command name)
Use ncdu. Your home directory can be written as ~. Add -r for safety.
Enter goes in, the left arrow goes back, and q quits.
Show Answer
$ ncdu -r ~
--- /home/user -------------------------------------------------
2.5 GiB [##########] /Videos
512.0 MiB [## ] /Downloads
64.0 MiB [ ] /Documents
The top row is the largest directory. In this example it is /Videos.
Press Enter to go inside and keep tracing the larger contents. The left arrow takes you one level back.
Exercise 2: Toggle the list between size order and name order.
Show Hint 1 (Direction)
A single key press switches it. You do not need to retype the command.
Each key is the first letter of an English word.
Show Hint 2 (Command name)
Size order is s (size). Name order is n (name). Alternate between them in the list view.
Show Answer
In the list view, alternate between s and n. The order changes instantly.
Press the same key again to flip between ascending and descending.
Exercise 3: Launch in a state where the delete key does nothing, and prove it to yourself.
Show Hint 1 (Direction)
A launch option disables the delete feature outright. The idea is to open it read-only.
The first letter of "read-only" is the clue.
Show Hint 2 (Command name)
Use ncdu -r. Point it at /tmp. After it opens, press d and watch what happens.
Show Answer
$ ncdu -r /tmp
Launching with -r disables the d key. No delete prompt appears.
Instead, the bottom of the screen shows File deletion disabled in read-only mode. That message is the proof -r is in effect.
Practise in this mode until you are comfortable.
9. Common Pitfalls
Conclusion: Watch out for missing sudo shrinking the numbers, an accidental
ddeleting the wrong thing, and aiming at/instead of your home.
Three Common Mistakes
- Scanning
/withoutsudo→ unreadable directories are skipped, so totals come out smaller than reality - Spotting something big and pressing
dat once → it has no effect when a service is using the file. Confirm what it is first - Operating on production without
-r→ an accidentalddeletes something. If you are just looking, always use-r
Safe Habits
- For system scans, use
sudo ncdu -x /(it counts only the same filesystem) - On production servers, launch with
-r(read-only) by default - Confirm name, size, and timestamp before deleting. When in doubt, do not
10. Review
ncdu scans once, and after that the arrow keys do all the drilling.Enter goes in and the left arrow comes back. Those two are enough.d acts on the selected row. I almost removed /log by accident.-r until you are comfortable. That alone prevents nearly every accident.Today's 3-Line Summary
ncdushowsduresults in an interactive screen, so the arrow keys do all the drillingssorts by size andnsorts by name.ddeletes the row that is selected- Add
-r(read-only) for practice and for inspection. Addsudoand-xfor system scans