ncdu Cheatsheet

Disk usage.

Overview

ncdu (NCurses Disk Usage) is the interactive disk-usage analyzer that turns "the disk is full" into a specific path within seconds. The TUI lets the operator drill into directories, sort by size, and delete from the UI. Fluency with the keyboard shortcuts is what makes ncdu fast under incident-time pressure when "df shows 95 percent" is all you have.

• Interactive tree. Browse directories with arrow keys; the largest hogs surface first when sorted by size.
• Sortable view. Sort by size, name, or item count; press ‘s’ for size, ‘n’ for name.
• Apparent vs disk usage. Toggle between file size and actual disk usage; catches sparse-file confusion that ‘du’ alone hides.
• Delete from UI plus save/load scans. ‘d’ key deletes the selected entry with confirmation; -o saves a scan, -f loads, supporting offline investigation.

The approach

The practical approach is to scan from a specific path (ncdu /var rather than ncdu / on a host with mounted filesystems), use -x to stay on one filesystem, save scans with -o for analysis on remote hosts where running ncdu interactively is hard, sort by size to find the largest items, and use the ‘d’ key with confirmation for fast cleanup with safety.

• ncdu /var. Start from a specific path; full-root scans on hosts with mounted filesystems take much longer.
• ncdu -x /. Stay on one filesystem; avoids crossing mount points and counting other volumes.
• ncdu -o scan.txt /. Save scan to a file; lets you analyse the scan offline or move it to a workstation.
• ‘s’ key plus ‘d’ key. Sort by size (s) to find the largest items; delete (d) with confirmation for fast cleanup.

Why this compounds

ncdu fluency compounds across incidents. Each scan teaches the file-system layout for that host; each cleanup turns disk-full from an incident into a 5-minute investigation. The team builds a muscle for disk-usage debugging that pays off every time pgsql logs fill /var or a runaway log drowns /opt.

• Faster cleanup. Fluent ncdu produces fast disk recovery; the disk-full alert becomes a 5-minute fix rather than a multi-hour investigation.
• Disk understanding. ncdu teaches what is actually consuming disk on each host; the team learns its own filesystem layout.
• Universal availability. ncdu is small and trivially installable on any Linux distro; the muscle applies everywhere.
• Institutional knowledge. Each session teaches storage patterns; the team learns where logs accumulate and which directories are at risk.

ncdu fluency is an operational discipline that pays off across years. Nova AI Ops integrates with system telemetry, surfaces disk patterns, and supports the team’s investigation discipline.