Disk usage analysis in linux

Most common approach if you have access to instal something is ncdu command

sudo apt update && sudo apt install ncdu -y

Second approach: 

 sudo du -xh --max-depth=2 --exclude=/mnt / 2>/dev/null | sort -hr | head -n 20

with progress bar: 

sudo du -xhd 2 --exclude=/mnt / 2>/dev/null | sort -rn | head -n 15 | awk '{printf "%-10s ", $1; max=50; bytes=$1; if(NR==1){max_val=bytes; if(max_val==0)max_val=1}; blocks=int((bytes/max_val)*max); bar=""; for(i=0;i<blocks;i++) bar=bar"#"; printf "%-50s %s\n", bar, $2}'

additional to exclude we can use

--exclude=/mnt --exclude=/media --exclude=/var/tmp

What to Look For (Common Targets)

When you read through your generated report, keep an eye out for these frequent culprits in those two specific directories:

In /var:

• /var/log/journal/: Systemd logs. If this is massive, cap it to 1 GB max using:
  sudo journalctl --vacuum-size=1G

  
/var/lib/docker/: If you run Docker, old dangling images and container logs hide here. Clean them safely with:
• (!) sudo docker system prune -a --volumes
  
  

  /var/cache/apt/archives/: Cached Ubuntu package installers. Clear them with:
• sudo apt-get clean

  
  

In /home:

• .cache/: Hidden application caches (like pip, npm, or browser data) inside specific user folders (e.g., /home/username/.cache). These can usually be safely deleted.
• Deleted files in trash: If users delete files via a desktop environment or certain CLI tools, they often just move to /home/username/.local/share/Trash/ instead of being erased