🛠️ ITBlogs.pro

Linux Disk Full: How to Find What Is Using the Space

Oct 16, 2026 · Linux · 3 min read

No space left on device, services crashing, databases refusing writes. Here's a systematic way to find where the space went, in the order that usually pays off.

1. Confirm which filesystem is full

df -h

Look at the Use% column. Note the mount point: cleaning /home won't help if /var is the full one.

2. Check inodes too

You can have free space but zero free inodes (millions of tiny files):

df -i

If IUse% is 100%, find the directory with a huge number of files (often session files, mail queues or cache):

sudo find /var -xdev -type f | cut -d/ -f1-4 | sort | uniq -c | sort -rn | head

3. Find the big directories

-x keeps du on one filesystem so it doesn't wander into other mounts.

sudo du -xh / --max-depth=1 2>/dev/null | sort -rh | head -15
sudo du -xh /var --max-depth=2 2>/dev/null | sort -rh | head -15

Drill down level by level. For an interactive view, install ncdu:

sudo apt install -y ncdu
sudo ncdu -x /

4. The usual suspects

Logs and the systemd journal

sudo journalctl --disk-usage
sudo journalctl --vacuum-size=200M      # or --vacuum-time=14d
sudo du -sh /var/log/* | sort -rh | head

Make it permanent in /etc/systemd/journald.conf: SystemMaxUse=200M. Huge plain-text logs? Truncate instead of deleting a file a process still has open:

sudo truncate -s 0 /var/log/big.log

APT cache and old packages

sudo apt clean
sudo apt autoremove --purge -y

Docker

docker system df
docker system prune            # stopped containers, dangling images, unused networks
docker image prune -a          # all unused images (be sure first)

docker system prune --volumes also deletes unused volumes, which may hold database data. Check before using it.

Snap old revisions

snap list --all | awk '/disabled/{print $1, $3}' | while read n r; do sudo snap remove "$n" --revision="$r"; done

Core dumps and temp files

sudo du -sh /var/lib/systemd/coredump /var/tmp /tmp 2>/dev/null

5. Deleted files that still use space

If df says the disk is full but du adds up to much less, a process is holding a deleted file open:

sudo lsof +L1

The space is freed only when that process closes the file. Restart the service named in the output:

sudo systemctl restart SERVICE

6. Last resorts

  • Reserved blocks (ext4): 5% is reserved for root by default. On a large data disk you can lower it: sudo tune2fs -m 1 /dev/sdX1. Don't do this on the root filesystem of a busy system.
  • Grow the disk (cloud resize + growpart + resize2fs) rather than playing whack-a-mole forever.

Prevent the next time

  • Rotate logs (logrotate) and cap the journal.
  • Alert at 80% disk usage, not at 100%.
  • Put databases, uploads and backups on their own volume, so one runaway log can't take everything down.
diskdockerlinuxtroubleshooting