The largest file: ls -S, find and sort

"The server ran out of space" happens regularly. The first thing you need to find is the heaviest files: an old log a gigabyte in size, a forgotten database dump, an archive in /tmp. In the previous lesson you measured space with du. Here the task is different: among many files, quickly pick the largest one, within one directory and across the whole tree.

Where to practice

The examples work in an ubuntu:24.04 container:

docker run --rm -it ubuntu:24.04 bash

On Linux and in WSL2 the commands work in a regular terminal too. On macOS, ls and find are from BSD; the differences are in "Common mistakes".

Create five files of different sizes:

mkdir -p /tmp/work
dd if=/dev/zero of=/tmp/work/a bs=1024 count=10 2>/dev/null
dd if=/dev/zero of=/tmp/work/b bs=1024 count=50 2>/dev/null
dd if=/dev/zero of=/tmp/work/c bs=1024 count=30 2>/dev/null
dd if=/dev/zero of=/tmp/work/d bs=1024 count=100 2>/dev/null
dd if=/dev/zero of=/tmp/work/e bs=1024 count=5 2>/dev/null

dd is already familiar from the previous lesson: each file gets count blocks of 1024 bytes.

Sorting within one directory: ls -S

ls -S sorts files by size, largest first:

ls -S /tmp/work

d
b
c
a
e

With -l you also see the sizes themselves, and -h turns them into K, M, G:

ls -lhS /tmp/work

total 204K
-rw-r--r-- 1 root root 100K Oct  9 18:50 d
-rw-r--r-- 1 root root  50K Oct  9 18:50 b
-rw-r--r-- 1 root root  30K Oct  9 18:50 c
-rw-r--r-- 1 root root  10K Oct  9 18:50 a
-rw-r--r-- 1 root root 5.0K Oct  9 18:50 e

The first total line is the sum of space for everything in the listing. It has nothing to do with the sorting. The -r flag reverses the order: ls -lSr puts the largest file last, next to the terminal prompt, so you don't have to scroll up through a long list.

If several files are the same size, ls -S puts them in alphabetical order.

Keep one name

The largest file comes first in ls -S output. head -1 keeps the first line, and > saves it to a file:

ls -S /tmp/work | head -1 > /tmp/answer

/tmp/answer ends up with d and a newline. It has to be ls -S, without -l: with ls -lS the first line is total 204, and head -1 would return that instead.

If you pass ls paths instead of a directory, the output will have paths:

ls -S /tmp/work/* | head -1

/tmp/work/d

When you need just the name, basename strips the path: basename /tmp/work/d prints d.

What ls -S does not see

ls only looks at one level. Create a subdirectory with a 500 KB file:

mkdir /tmp/work/sub
dd if=/dev/zero of=/tmp/work/sub/big bs=1024 count=500 2>/dev/null
ls -lS /tmp/work

total 208
-rw-r--r-- 1 root root 102400 Oct  9 18:50 d
-rw-r--r-- 1 root root  51200 Oct  9 18:50 b
-rw-r--r-- 1 root root  30720 Oct  9 18:50 c
-rw-r--r-- 1 root root  10240 Oct  9 18:50 a
-rw-r--r-- 1 root root   5120 Oct  9 18:50 e
drwxr-xr-x 2 root root   4096 Oct  9 18:50 sub

The sub directory is in the list, but with a size of 4096: that's the directory entry itself, not its contents. ls never noticed the 500 KB file inside it.

Two more blind spots:

• Hidden files (name starting with a dot) aren't shown by ls without -a. ls -AS includes them in the sort, while still not printing . and ...
• ls -S sorts by file length, the same number as in the size column of ls -l. A sparse file (truncate -s 1G) will end up on top even though it barely takes up any space on disk. You saw the difference between length and space in the previous lesson.

Searching the whole tree: find

To walk all subdirectories, you need find. -type f keeps only regular files, no directories. -exec du -k {} + computes the space for each file found, sort -n orders the numbers ascending, tail -1 takes the last line:

find /tmp/work -type f -exec du -k {} + | sort -n | tail -3

52	/tmp/work/b
100	/tmp/work/d
500	/tmp/work/sub/big

{} in -exec is replaced with the names of the files found, and + at the end passes them to du in a batch. You can also see disk space here: b at 50 KB takes up 52, because space is allocated in 4 KB blocks.

If you need the length in bytes, GNU find has -printf:

find /tmp/work -type f -printf '%s %p\n' | sort -n | tail -1

512000 /tmp/work/sub/big

%s is the length in bytes, %p the path.

When there are thousands of files, it's more convenient to cut off the small ones right away. -size +100k means "larger than 100 KB":

find /tmp/work -type f -size +80k

/tmp/work/sub/big
/tmp/work/d

The + sign is strict: with -size +100k, a file d at exactly 100 KB won't make it into the results. For megabytes, use M: find /var/log -type f -size +100M.

Why not du -a

du -a prints the space for every file and directory in the tree, and it seems like all you need is to sort it:

du -a /tmp/work | sort -rn | head -3

712	/tmp/work
504	/tmp/work/sub
500	/tmp/work/sub/big

The directory itself ends up on top: its number includes every file inside it. Below it, a subdirectory, and only on the third line, a file. With du -a you'd have to skip directories by eye, while find -type f drops them right away.

Common mistakes

• ls -lS | head -1: you get the total ... line in the answer. For a name, use ls -S without -l.
• ls -S /tmp/work/* | head -1: the answer is a path, not a name. Strip it with basename, or run ls -S on the directory itself.
• ls -S at the top level, when the large file sits deeper. For a tree, you need find ... -type f.
• du -a | sort -rn | head -1: the directory itself comes first.
• sort without -n: numbers are compared as text, 8 ends up after 52 and 500, and tail -1 returns the 8 KB file. For du -h output with suffixes, you need sort -h: sort -n would put 10M before 200K.
• macOS: ls -S, -size +100k, and -exec du -k {} + work the same way. BSD find has no -printf flag (find: -printf: unknown primary or operator), use the du -k variant instead. du -a without -k counts in 512-byte blocks.

What you'll need for the tasks

• Sort files in a directory with ls -S and keep the first name with head -1.
• Save the result to a file with > and check it with cat.
• Find the largest file in the whole tree with find ... -type f -exec du -k {} + | sort -n | tail -1.