Freeing Up Disk Space on Linux: Fixing the ENOSPC Error

What the ENOSPC Error Means

The ENOSPC error (errno code 28, message No space left on device) occurs when the file system cannot write new data due to a complete lack of free space on the target partition. You will encounter it when trying to save files, install updates, deploy containers, or start databases. At this point, the system switches to read-only mode for some services, which often leads to process hangs and data loss.

Common Causes

• Accumulation of system logs: The systemd-journald daemon or third-party application logs are not rotated and consume gigabytes in /var/log or /var/lib/docker.
• Package manager cache: Package managers like apt, dnf, or pacman retain .deb and .rpm archives after installation without automatically deleting them.
• Outdated OS kernels: After each major update, the system retains previous kernel versions, which can take up 500 MB to 2 GB each.
• Orphaned or forgotten containers: Docker/Podman leave behind unused images, volumes, and layers that quickly fill up /var/lib/docker.
• Inode table exhaustion: The file system partition is filled not by large files, but by millions of small ones (PHP temporary sessions, mail queues), causing structural pointers to run out.

Solutions

Method 1: Clear the Package Manager Cache

This is the safest method, as it does not affect system configurations or user data. Open a terminal and run the appropriate command for your distribution:

# For Debian/Ubuntu
sudo apt clean
sudo apt autoremove
# For Fedora/RHEL/CentOS
sudo dnf clean all
sudo dnf autoremove

The clean command removes all pre-downloaded packages from /var/cache/apt/archives, while autoremove identifies and removes libraries that were installed as dependencies for programs you have already uninstalled. After execution, you will immediately free up 500 MB to 3 GB.

💡 Tip: If space has been freed but the error persists, restart the affected services using sudo systemctl restart <service_name> to force them to close file descriptors pointing to deleted files.

Method 2: Find and Remove Large Files

If the cache isn't taking up much space, locate files that have grown over time. Use the find utility with a size parameter:

# Find files larger than 500 MB on the root filesystem
sudo find / -xdev -type f -size +500M -exec du -h {} \; | sort -rh | head -n 10

The -xdev flag prevents searching across mounted external drives, and sort -rh sorts the results in descending order by size. Review the output carefully. If the list includes application logs (e.g., access.log or error.log from a web server), truncate them instead of deleting:

# Safe truncation without restarting the service
sudo truncate -s 0 /var/log/nginx/access.log

Method 3: Remove Old Kernels and systemd Journals

Linux kernels often remain on the system after failed or interrupted updates. Check your currently active kernel with uname -r and remove the rest via your package manager. On Ubuntu/Debian, this can be automated:

sudo apt autoremove --purge

For journalctl system logs, set a strict storage limit. By default, systemd may not restrict the log size, which is critical on SSDs:

# Keep only the last 500 MB of logs
sudo journalctl --vacuum-size=500M
# Check current log disk usage
sudo journalctl --disk-usage

⚠️ Warning: Do not manually delete files in the /boot or /lib/modules directories. Doing so will break system boot. Always use apt or dnf.

Method 4: Check Inode Usage

If df -h shows available space but writing is still impossible, you have likely run out of inodes. Verify this with:

df -i

Pay attention to the IUse% column. If the value is close to 100%, locate the directory with the highest number of files:

# Analyze file counts in top-level directories
sudo find / -xdev -type d -exec sh -c 'echo "$(ls -1A "$1" | wc -l) $1"' _ {} \; | sort -rn | head -n 10

The issue usually lies in /var/spool/postfix, /tmp, or PHP session directories. Remove old files from these locations using find ... -delete or rm, then restart the affected services.

Prevention

To prevent the ENOSPC error from recurring, configure automatic log rotation. Create or edit /etc/systemd/journald.conf and set the SystemMaxUse=1G and MaxRetentionSec=1month parameters, then apply the changes with sudo systemctl restart systemd-journald.

For packages, add a simple cache-cleaning script to /etc/cron.weekly/. Integrate disk space monitoring into zabbix, prometheus, or set up email alerts using df -h piped to mail. If you work heavily with containers, regularly run docker system prune -f or configure automatic removal of unused images via the Docker daemon.json policy.