Linux Disk Full: Find What's Using Space and Free It Safely

Symptoms

• Websites return errors or blank pages, and databases refuse writes or crash
• Commands fail with No space left on device
• Email stops being delivered, or backups fail
• Services won't start after a reboot

Step 1: Confirm which filesystem is full

df -h

Look for any filesystem at or near 100% in the Use% column. Note its mount point (/, /var, /home and so on).

Also check inodes. A disk can report free space but still refuse new files if it has run out of inodes, which usually means millions of tiny files such as session or cache files:

df -i

If IUse% is at 100%, skip to "Too many small files" below.

Step 2: Find the biggest directories

Starting at the full mount point, list directory sizes, staying on that one filesystem (-x):

du -xh --max-depth=1 / 2>/dev/null | sort -h | tail -15

Repeat the command on the largest directory, for example du -xh --max-depth=1 /var | sort -h, until you find what's taking the space. For an interactive view, install ncdu (dnf install ncdu or apt install ncdu) and run ncdu -x /.

Step 3: Free space from the usual suspects

Oversized log files

Find the largest logs:

find /var/log -type f -size +100M -exec ls -lh {} \; 2>/dev/null

truncate -s 0 /var/log/example.log

Then find out why the log grew. A log that fills a disk is usually recording a recurring error that needs fixing.

The systemd journal

# See how much space the journal uses
journalctl --disk-usage

# Keep only the last 14 days
journalctl --vacuum-time=14d

# Or cap it at a fixed size
journalctl --vacuum-size=500M

To make the cap permanent, set SystemMaxUse=500M in /etc/systemd/journald.conf and run systemctl restart systemd-journald.

Package manager caches

# AlmaLinux / Rocky / RHEL
dnf clean all

# Ubuntu / Debian
apt clean

Old kernels

# AlmaLinux / Rocky / RHEL: keep the two newest kernels
dnf remove --oldinstallonly --setopt installonly_limit=2 kernel

# Ubuntu / Debian: remove kernels and packages no longer needed
apt autoremove --purge

Deleted files that are still open

If df says the disk is full but du can't account for the space, a process is probably holding deleted files open:

lsof +L1 2>/dev/null | sort -k7 -n -r | head -20

The COMMAND column shows which service holds them. Restarting that service, for example systemctl restart httpd, releases the space.

Database binary logs

MySQL and MariaDB binary logs can grow large on busy servers. Check them with SHOW BINARY LOGS;, then purge old ones:

PURGE BINARY LOGS BEFORE NOW() - INTERVAL 7 DAY;

Old backups and archives

Backups stored on the same disk they protect are a very common cause, as are forgotten .tar.gz and .sql dumps in home directories. On cPanel servers, check /backup and each account's home directory. Move backups off the server rather than deleting them blindly.

Too many small files (inodes full)

Find which directory holds the most files:

du --inodes -x / 2>/dev/null | sort -n | tail -15

Typical causes are PHP session directories, application cache folders and mail queues. Clear the offending cache through the application where possible, and fix whatever stopped cleaning it up.

Verify the fix

df -h
df -i

Usage should now be well below 90%. Restart any services that failed while the disk was full, for example the database and web server, and confirm your sites load.

Prevent it from happening again

• Set up disk-usage alerts at 80% and 90%, so you hear about it days before it becomes an outage.
• Make sure logrotate covers every application log, with compression and a retention limit.
• Cap the systemd journal size permanently.
• Store backups off-server.

This is exactly the kind of slow-building problem our monitoring and proactive server management catch before it takes a site down.