find the largest file in whole system

find the largest file in whole system

open a bottle of wine

After the wine try

find / -type f -exec  ls -s {} \; | sort -n | tail -1

This will take a long time.

To find files greater than 3 GB, enter the following:
find / -size +3000000000c -exec ls -l {} \;

If one assumes the file to be above a certain threshold, the process can be somewhat quickened by combining a couple of the suggestions given so far. Perhaps try something like:

find / -size +100000c 2>/dev/null -exec ls -l {} \; | sort +4 | tail -3

This will:
only look for files larger than 100,000
redirecting errors, like directories not allowed to be viewed because of security rights
and therefore, sort a smaller set
and then give info on three largest it finds

Yet another slight refinement special for not too dated find commands on HP-UX
(don't know which PHCO_* patch this was, search HPs' online patch database)
would be to use the plus instead of the trailing semicolon with find commands.
Then it would rather behave like piped to xargs for the exec-ed command
which improves performance and thus decreases waiting time.
e.g. looking for file exceeding 2GB (which would require largefiles support)

# find / -type f -size +4194304 -exec ll {} +

Here is the excerpt from find's manpage regarding the -exec and + speciality

      -exec cmd                True if the executed cmd returns a zero value
                               as exit status.  The end of cmd must be
                               punctuated by a semicolon (;) or a plus sign
                               (+) (semicolon and plus are special to the
                               shell and must be escaped).  When + is used,
                               cmd aggregates a set of path names and
                               executes on the set.  Any command arguments
                               between the first occurrence of {} and + are
                               ignored.  The reason for preferring + to a ;
                               is vastly improved performance.  Any command
                               argument {} is replaced by the current path
                               name.  cmd may contain supplementary code set
                               characters.

On my HP box the + thingy seems to have come with this patch

# swlist -l product|grep PHCO.*find
  PHCO_36502            1.0            find(1) cumulative patch 

which can be read from

$ /usr/sbin/swlist -l fileset -a readme PHCO_36502 | more

find / -type f -xdev -print | xargs -e ll | sort -rn -k5 | head -n 1