ncdu: Interactive Disk Usage Analyzer

2026-06-05 Reading time: About 9 min Difficulty: Beginner

What You'll Learn

How to use ncdu to navigate large directories interactively
How to find big files and delete them safely on the spot
How to switch from hammering du to a keystroke-only investigation
How to scan a remote server's disk over ssh

Target Audience: Linux beginners, anyone tired of chasing space with du

Introduction: Lina's "du Spam" Incident

Lina: Linny-senpai, the disk filled up so I'm hunting big directories with du. But it's run du, cd into a deeper folder, run du again, cd again... this is taking forever.

Linny-senpai: Ah, the classic "du spam." Everyone goes through it once. The thing is, there's a dedicated tool called ncdu that does all of that with just the arrow keys.

Lina: Just arrow keys? No cd, no du?

Linny-senpai: Right. ncdu lets you walk around the screen like a file manager, drill into the biggest directories, and even delete them right there. Let's learn it together.

The Short Answer

ncdu = NCurses Disk Usage. A tool that shows du results in an interactive screen
Move with arrow keys, delete in place with d, sort by size with s
Just install it with sudo apt install ncdu and launch ncdu /

1. What Is ncdu?

Conclusion: ncdu shows du results in a full-screen interactive view, so you can drill into the biggest paths with arrow keys.

Lina: What does ncdu even stand for?

Linny-senpai: "NCurses Disk Usage." NCurses is a library for building full-screen terminal UIs, and ncdu uses it to display du-style results.

Lina: So it's like a beefed-up du?

Linny-senpai: That's a fair mental model. du just dumps numbers, but ncdu sorts them biggest-first, lets you Enter into a directory, and back out. You reach the space hog without getting lost.

ncdu vs du (in a nutshell)

du → run the command once and get a list of numbers (then cd and re-run yourself)
ncdu → scan once, then just walk around the screen to drill down

2. Install and Launch

Conclusion: ncdu is often not installed by default. Install it via apt / dnf, then launch with ncdu PATH.

Lina: I want to try it right now! How do I install it?

Linny-senpai: The package is named ncdu across distributions. Let's start with the install.

Install

# Ubuntu / Debian family
$ sudo apt install ncdu

# RHEL / Fedora family
$ sudo dnf install ncdu

# Older CentOS, etc.
$ sudo yum install ncdu

Launch It

# Scan the current directory
$ ncdu

# Scan a specific path
$ ncdu /var

# Scan the whole root (sudo recommended)
$ sudo ncdu /

Lina: I ran ncdu / and it showed "Scanning..." and made me wait.

Linny-senpai: That's expected. On launch, ncdu scans everything under the given path once. Just like du, a large target takes a moment. When the scan finishes, it switches to the list view.

Use sudo for System-Wide Scans

Under / there are directories a normal user can't read. Without sudo, you get "Permission denied" and those parts go uncounted, so the totals come out too small. For system investigation, sudo ncdu / is the baseline.

Conclusion: Up/down arrows select an item, Enter (or right arrow) enters a directory, left arrow goes back up, and q quits.

Linny-senpai: Once the scan finishes, you get a screen like this. The key point: items are sorted biggest first.

--- /var ------------------------------------------------------
    1.2 GiB [##########] /log
  512.0 MiB [####      ] /cache
   24.0 MiB [          ] /lib
    4.0 KiB [          ] /games

How to Read It

The number on the left: usage of that directory or file
[#### ]: a bar visualizing its share of the parent
The / before a name: marks a directory
The top --- /var ---: where you currently are

Core Key Bindings

Movement Keys (learn just these first)

Key	Action
`↑` / `↓`	Select an item (move up/down)
`Enter` or `→`	Enter the selected directory
`←`	Go back up to the parent
`q`	Quit ncdu
`?`	Show help (key list)

Lina: So I move the cursor over the file list and press Enter to go inside... it really is like a file manager.

Linny-senpai: Right? No cd, no du — just arrow keys to dive into the biggest directory. That's the joy of ncdu.

4. Sorting and Display Toggles

Conclusion: s sorts by size, n by name, C by item count, and g toggles the percentage/graph display.

Lina: Can I change the sort order?

Linny-senpai: Of course. The default is biggest-first, but you can switch it based on what you're after.

Sort and Display Keys

Key	Action
`s`	Sort by size (default)
`n`	Sort by name
`C`	Sort by item count (capital C)
`g`	Toggle the percentage / graph bar display
`a`	Toggle apparent size vs. actual disk usage

When to Use a (apparent size)

By default ncdu shows the block size actually occupied on disk. Press a to switch to the file's "apparent size." The two diverge for sparse files or lots of tiny files, so knowing the difference saves confusion.

5. Deleting on the Spot

Conclusion: Select an item and press d. A confirmation prompt appears, so you skip the round trip of finding with du and removing with rm.

Lina: I found the big directory, but do I quit ncdu and run rm to delete it?

Linny-senpai: No need. Inside ncdu, select the item you want gone and press d. It asks for confirmation before deleting, so the whole "find with du, remove with rm" round trip disappears.

Deletion Steps

Select the file/directory with ↑ / ↓
Press d
Choose y (yes) / n (no) at the confirmation prompt

d Is a Real Delete. There's No Undo

ncdu's d removes the data just like rm. Nothing goes to a trash can. Always confirm the name, size, and timestamp before deleting. Especially under sudo ncdu /, removing a system file by mistake can leave the box unbootable. If you're unsure, don't delete.

Pre-Delete Checklist

Is the file truly unneeded (log / cache / temp)?
Is a running service using it? (For the "deleted but space didn't return" open-file problem, see Understanding du vs df)
For large logs, emptying the file in place without stopping the service is sometimes safer than deleting

6. Options That Matter in Practice

Conclusion: -x stays within one filesystem, -r is read-only, and -o / -f export and reuse a scan.

Linny-senpai: Knowing a few launch options makes your investigation more accurate and safer.

Common Launch Options

Option	Meaning
`-x`	Count only the same filesystem (don't cross mounts)
`-r`	Launch in read-only mode (disables `d` deletion)
`-o FILE`	Export the scan result to a file
`-f FILE`	Import an exported result and display it
`--exclude PATTERN`	Exclude matching paths from the count

Lina: Isn't -x the one that came up with du?

Linny-senpai: Good memory. Same as du -x: when /home is a separate partition, it keeps you from double-counting across the boundary. Handy when you want to compare against df.

Use -r When Safety Comes First

To prevent an accidental d keystroke, launch with sudo ncdu -r /. With -r the delete feature is disabled, so it's investigation-only. Great for "just looking" on a production server.

7. Scanning a Remote Server's Disk

Conclusion: Stream a remote scan to your machine over ssh and read it with ncdu -f-, so you can investigate interactively without installing anything extra locally.

Lina: I want to check a server's disk, but ncdu isn't installed on it...

Linny-senpai: Sharp observation. ncdu can export / import scan results, and combined with ssh that solves it.

Pattern A: Scan Remotely, View Locally

# Run only the du-style scan remotely and pipe the result into your local ncdu
$ ssh user@server ncdu -o- / | ncdu -f-

How to Read It

ncdu -o-: write the scan result to standard output (- means stdout)
ncdu -f-: read the result from standard input and display it
The | between them: pipe the remote output into your local ncdu

Note: -o still requires ncdu on the remote side. If it's truly not installed there, use Pattern B with a file.

Pattern B: Save the Result and Carry It Home

# On the server, save the result (gzip keeps it small)
$ ncdu -o- / | gzip > scan.gz

# Transfer and load it locally
$ scp user@server:scan.gz .
$ zcat scan.gz | ncdu -f-

Lina: If I can dump the scan to a file, a nightly batch could save them periodically and I'd be able to trace "when did it get fat."

Linny-senpai: Love that instinct. Keeping export files over time gives you a ready-made trail for investigating capacity growth.

8. Mini Exercises: Try It on Your Box

Conclusion: Three drills — find your largest home directory, toggle sort modes, and launch read-only — to lock in the controls.

Linny-senpai: To make it stick, run these on your own system — not production, start local.

Exercise 1: Run ncdu ~ and find the largest directory directly under your home.

Exercise 2: Press s and n in the list to confirm it toggles between size and name order.

Exercise 3: Launch ncdu -r /tmp and confirm that pressing d does not delete (read-only).

Hint for Exercise 1

ncdu ~

After launch, look at the top item (biggest, since the default sort is by size). Press Enter to go inside and keep tracing the larger contents.

Hint for Exercise 2

In the list view, alternate between s (size) and n (name). The order changes instantly. Press the same key again to flip ascending / descending.

Hint for Exercise 3

ncdu -r /tmp

Launching with -r (read-only) disables the d key — you won't even get a delete prompt. Proof it's safe for investigation-only use.

9. Common Pitfalls

Conclusion: Watch out for missing sudo shrinking the numbers, an accidental d deleting the wrong thing, and aiming at / instead of your home.

Three Common Mistakes

Scanning / without sudo → unreadable directories are skipped and totals come out smaller than reality
Spotting something big and immediately pressing d → counterproductive when it's an open-deleted file or in use by a service; confirm what it is first
Operating on production without -r → an accidental d deletes something. If you're just looking, always use -r

Safe Habits

For system scans: sudo ncdu -x / (same filesystem only, no crossing)
On production servers, launch with -r (read-only) by default
Confirm name, size, and timestamp before deleting. When in doubt, don't