Linux Server Disk Space Troubleshooting Guide
A full disk is one of the most common causes of server outages. When a filesystem reaches 100% utilization, databases crash, applications fail, and logging stops. This guide covers how to identify disk space consumers and safely reclaim space.
Diagnosing Disk Space Issues
Check Overall Usage
Run df -h to see filesystem usage. Focus on the Use% column. Any filesystem above 80% warrants investigation. At 90%, take immediate action. At 100%, services are likely already failing.
Find Large Directories
Start from the root and drill down: du -sh /* 2>/dev/null | sort -rh | head
This shows the largest top-level directories. Navigate into the largest ones and repeat: du -sh /var/* | sort -rh | head
Continue drilling down until you identify the specific directories consuming space.
Find Large Files
To find individual large files: find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh | head -20
This lists files larger than 100 MB, sorted by size.
Common Disk Space Consumers
Log Files
Log files are the most common cause of disk space issues. Key locations: - /var/log/syslog or /var/log/messages: system logs - /var/log/nginx/ or /var/log/apache2/: web server logs - /var/log/journal/: systemd journal
Clean up: - Truncate large log files: truncate -s 0 /var/log/large-file.log - Remove old rotated logs: find /var/log -name "*.gz" -delete - Limit journal size: journalctl --vacuum-size=500M
Configure log rotation for application logs to prevent recurrence.
Package Manager Cache
Package managers cache downloaded packages:
Ubuntu/Debian: sudo apt clean (removes cached packages) CentOS/RHEL: sudo dnf clean all
Old Kernels
Old kernel packages accumulate over time: Ubuntu: sudo apt autoremove --purge CentOS: sudo dnf remove $(dnf repoquery --installonly --latest-limit=-1 -q)
Temporary Files
/tmp and /var/tmp accumulate temporary files. Safe cleanup: sudo find /tmp -type f -atime +7 -delete
Check application-specific temporary directories as well.
Docker Storage
Docker images, containers, and volumes can consume significant space:
Remove unused images: docker image prune -a Remove stopped containers: docker container prune Remove unused volumes: docker volume prune Remove all unused resources: docker system prune -a --volumes
CAUTION: docker system prune -a removes all unused images and volumes. Verify nothing important is stored in Docker volumes before running this.
Database Files
Database data directories can grow significantly: - PostgreSQL: /var/lib/postgresql/ - MySQL/MariaDB: /var/lib/mysql/
Database files should not be manually deleted. Instead, use the database's built-in cleanup tools: - PostgreSQL: VACUUM to reclaim dead tuple space - MySQL: OPTIMIZE TABLE to defragment tables
Preventing Disk Space Issues
Set Up Monitoring
Configure alerts for disk usage thresholds (80% warning, 90% critical). Use monitoring tools or simple cron scripts that send alerts when usage exceeds thresholds.
Configure Log Rotation
Ensure all application logs have proper rotation configured. Set maximum sizes and retention periods appropriate for your environment.
Schedule Regular Cleanup
Create cron jobs for regular maintenance: - Weekly: clean package cache - Weekly: rotate and compress logs - Monthly: remove old backups beyond retention period - Monthly: prune Docker resources if using containers
Provision Adequate Storage
When provisioning servers, allocate storage with growth in mind. Cloud VPS platforms allow storage expansion as needs grow. Monitor usage trends and expand before hitting limits.
Emergency Recovery
If the disk is already full and services are failing: 1. Identify the quickest space to reclaim (usually log files) 2. Truncate rather than delete large log files (truncate -s 0 file.log) 3. Clear package caches 4. Remove old backups or move them to external storage 5. Restart affected services after freeing space 6. Verify database integrity after disk-full events
Speed matters in an emergency. Truncating a 10 GB log file takes seconds and immediately restores service operation. ## Key Takeaways
- The most common disk space culprits are log files, package caches, old Docker images, and stale backups — start your investigation there
- In an emergency, truncate large log files rather than deleting them while services are running to avoid breaking file handles
- Set up logrotate, automated cleanup cron jobs, and Docker prune routines to prevent space issues from recurring
- Provision with growth in mind and monitor usage trends so you can expand storage before hitting critical limits