Sort Files and Directories by Size with du on Linux

When a partition fills up, du answers which directories and files account for the space. By itself it walks the tree in discovery order; piping the output to sort puts the largest or smallest entries at the top.

The examples below use a small lab tree on vm1.lab.example at /tmp/du-lab with a 15M file, log files, and a tiny text file. Replace that path with the directory you are investigating.

Quick answer

Pipe du to sort -h so K, M, and G sizes order correctly. Add -r for largest first; omit it for smallest first.

Prepare a lab directory (optional)

Create a small tree so the sample output matches what you run:

LABDIR=/tmp/du-lab
rm -rf "$LABDIR"
mkdir -p "$LABDIR"/{logs,archive,small}
dd if=/dev/zero of="$LABDIR/archive/big.bin" bs=1M count=15 status=none
dd if=/dev/zero of="$LABDIR/logs/app.log" bs=1M count=3 status=none
dd if=/dev/zero of="$LABDIR/logs/rotated.log.1" bs=512K count=1 status=none
dd if=/dev/zero of="$LABDIR/small/note.txt" bs=1K count=10 status=none
printf "x" > "$LABDIR/small/tiny.log"

The fixture finishes silently when dd succeeds. Use du -sh "$LABDIR" afterward if you want a one-line total before sorting. Remove the tree with rm -rf /tmp/du-lab when you are done.

Sort largest subdirectories

To rank immediate children without listing every nested file, cap depth at one and sort descending:

du -h --max-depth=1 /tmp/du-lab | sort -rh | head

Sample output:

19M	/tmp/du-lab
15M	/tmp/du-lab/archive
3.5M	/tmp/du-lab/logs
16K	/tmp/du-lab/small

The first line is the whole tree total; the lines below are each subdirectory's aggregate. That is usually the fastest first pass on a full disk — see which top-level folder dominates before you drill deeper.

Sort largest files and directories

Add -a when you need individual files, not just folder totals:

du -ah /tmp/du-lab | sort -rh | head

Sample output:

19M	/tmp/du-lab
15M	/tmp/du-lab/archive/big.bin
15M	/tmp/du-lab/archive
3.5M	/tmp/du-lab/logs
3.0M	/tmp/du-lab/logs/app.log
512K	/tmp/du-lab/logs/rotated.log.1

Directory lines still appear because du prints totals for each directory it visits. The single 15M file stands out clearly in the sorted list.

Sort smallest files and directories

Omit -r on sort to list smallest entries first:

du -ah /tmp/du-lab | sort -h | head

Sample output:

4.0K	/tmp/du-lab/small/tiny.log
12K	/tmp/du-lab/small/note.txt
16K	/tmp/du-lab/small
512K	/tmp/du-lab/logs/rotated.log.1
3.0M	/tmp/du-lab/logs/app.log

That pattern helps surface entries using the least disk space, including small files and directories.

Limit how deep du walks

--max-depth=1 on a production path such as /var keeps the listing readable:

du -h --max-depth=1 /var | sort -rh | head

Run that with sudo if your user cannot read every subdirectory. Increase the depth when one subdirectory is large but you still need more detail:

du -h --max-depth=2 /tmp/du-lab | sort -rh | head

Pair depth limits with df and du when you need mount-point totals versus directory breakdowns on the same host.

Filter by file extension

grep after du keeps only paths whose names match a pattern:

du -ah /tmp/du-lab | grep '\.log$' | sort -rh

Sample output:

3.0M	/tmp/du-lab/logs/app.log
4.0K	/tmp/du-lab/small/tiny.log

Anchor the pattern with $ so rotated.log.1 does not match when you only want paths that end in .log. For complex rules, find with -size may fit better than chaining many grep stages.

Filter by size threshold with numeric du

Filtering the human-readable du -h column in awk breaks when sizes use mixed suffixes (512K next to 3.0M). Use du -k for numeric 1 KiB block counts. Add -a (du -ak) when individual files should also be included, then compare numbers in awk:

du -ak /tmp/du-lab | awk '$1 >= 1024' | sort -rn

Sample output (paths at or above 1 MiB):

18960	/tmp/du-lab
15360	/tmp/du-lab/archive/big.bin
15360	/tmp/du-lab/archive
3584	/tmp/du-lab/logs
3072	/tmp/du-lab/logs/app.log

Each unit in column one is a kilobyte when you use -k. Examples for other thresholds:

Append | awk '{printf "%10.1fM\t%s\n", $1/1024, $2}' only if you want megabytes in the display after numeric filtering.

Show modification time with du --time

Add --time when you want to see when large files last changed, then sort by size as usual:

du -ah --time /tmp/du-lab/logs | sort -rh | head

Sample output:

3.5M	2026-08-21 17:15	/tmp/du-lab/logs
3.0M	2026-08-21 17:15	/tmp/du-lab/logs/app.log
512K	2026-08-21 17:15	/tmp/du-lab/logs/rotated.log.1

With --time, GNU du inserts the modification date and time between the size and path. Keep sort -rh on the size column when you are still ranking by disk usage.

Troubleshooting

References

• GNU coreutils — du invocation
• GNU coreutils — sort invocation

Summary

du measures disk usage under a path; sort reorders the result so the biggest or smallest entries surface first. For a quick triage pass, du -h --max-depth=1 … | sort -rh | head ranks immediate subdirectories without drowning you in every nested file.

When you need specific large files, add -a and keep sort -rh. Extension filters belong in grep; size thresholds belong in numeric du -k output parsed by awk, not in fragile regexes against 512K and 3.0M strings in the same column.

After you identify the heavy paths, decide whether to archive, truncate, or delete — and use df on the mount point to confirm how much space you need back. For mount-level reporting and du depth flags in one place, keep df and du commands nearby when a filesystem alarm fires.