ncdu for Disk Usage Investigation

ncdu shows disk usage interactively.

Usage

ncdu (NCurses Disk Usage) is the interactive disk usage tool. Where du produces text output, ncdu produces an interactive interface; the team navigates the filesystem visually and identifies space hogs quickly.

What basic usage looks like:

• ncdu / scans from root.: The command scans starting from the root path (or whichever path is specified). The scan calculates per-directory sizes; the output is a sortable interactive view.
• Interactive sort.: The output is sorted by size by default. Arrow keys navigate; entering a directory drills down; backspace returns. The interaction is intuitive.
• Find big files in seconds.: The team can identify the largest directories and files in seconds. The visual presentation accelerates investigation; the underlying filesystem is the same data du would show.
• Initial scan time.: The first scan takes time proportional to filesystem size. A 1TB disk might take minutes; the team waits during the scan; the result is the snapshot.
• Refresh after changes.: If files change during investigation, ncdu's view becomes stale. Pressing 'r' re-scans the current directory; the view updates.

Basic usage is straightforward. The interactive nature accelerates investigation compared to text-only tools.

Alternatives

du is the traditional alternative. For scripted use, du fits better; for interactive investigation, ncdu wins. Both have their place.

• du -sh asterisk slash for scripted use.: The du command with -sh produces summary sizes per top-level directory. The output is text; can be piped to other tools; suitable for scripts and automation.
• ncdu interactively beats du.: For interactive investigation, ncdu is faster than du. The team explores the tree visually; reads the largest entries; drills down; the workflow is faster.
• du for cron jobs.: Scheduled disk-usage reports use du. The output is parseable; the cron job runs without interactive output; the data is captured.
• ncdu for incident response.: When the team needs to find large files quickly during an incident, ncdu is faster. The interactive exploration produces results in seconds.
• Both are widely available.: Most Linux distributions have both. The team's existing servers usually have them; the choice is preference, not availability.

The alternatives are both useful. The team uses each where it fits.

When

ncdu is reached for during disk-full incidents. The team needs to find what is consuming space; ncdu produces the answer fast.

• Disk-full incidents.: When a server's disk is full, the team needs to know what is consuming space. ncdu produces the answer in seconds; the cleanup target is identified; the cleanup proceeds.
• Identify culprit fast.: The interactive sort surfaces the largest entries. The team's eyes find the big consumers quickly; the investigation is targeted.
• Always installed on production hosts.: The team's standard server image includes ncdu. Production hosts have it ready; incident response does not require installing tooling.
• Pre-emptive use.: Before incidents, ncdu can be used for capacity awareness. Periodic scans surface growth patterns; the team identifies and addresses growth before it becomes an incident.
• Combined with other tools.: ncdu identifies what is consuming disk; other tools (logrotate, find, retention scripts) handle the actual cleanup. The combination produces the discipline.

ncdu for disk usage is one of those tooling skills that pays off in incident response. Nova AI Ops integrates with system telemetry, surfaces disk patterns at scale, and complements local-tool investigation.