Linux Disk Full: Quick Step-by-Step Guide to Freeing Up Space

A situation where a Linux server or workstation suddenly displays the error "No space left on device" is familiar to many administrators and users. The system stops working correctly: updates won't install, logs can't be written, databases fail. This problem is critical and requires immediate resolution.

In this guide, you'll get a concrete, step-by-step plan for diagnosing and freeing up disk space on Linux. We'll cover only working commands relevant to most distributions (Ubuntu, Debian, CentOS, RHEL, Arch) and provide prevention recommendations.

🔍 Step 1: Diagnosis — Where Exactly Did the Space Run Out?

First, you need to understand which specific filesystem is full. The issue might not be in the root /, but in a separately mounted partition like /var or /home.

df -h

Key columns:

• Filesystem — the device or partition.
• Size — total size.
• Used — used space.
• Use% — usage percentage. Watch for values 90-100%.
• Mounted on — mount point.

Example output:

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   48G  1.5G  97% /
/dev/sdb1       200G   30G  160G  16% /home
tmpfs           7.8G  1.2G  6.6G  16% /tmp

Here the problem is the root partition (/).

⚠️ Important: If the df command doesn't show the problem, check inodes (file indexes)—they can also be exhausted: df -i.

📊 Step 2: Finding the "Space Hogs"

After identifying the problematic partition, find which directories and files occupy the most space.

Method A: Standard du and sort utilities

# Analysis of the 20 largest directories in root (ignore access errors)
sudo du -x / 2>/dev/null | sort -n | tail -20

• -x — stay on one filesystem (don't go into other mounted partitions).
• sort -n — numeric sort by size (ascending).
• tail -20 — take the last 20 lines (the largest).

The result will look like this:

5242880    /var/lib/docker
3145728    /usr/lib/jvm
2097152    /var/log
...

This shows that /var/lib/docker is the prime candidate for cleanup.

Method B: Interactive analysis with ncdu (recommended)

Install ncdu — the most convenient tool for disk space analysis.

# For Ubuntu/Debian
sudo apt update && sudo apt install ncdu

# For CentOS/RHEL (EPEL repository)
sudo yum install epel-release && sudo yum install ncdu

# For Arch
sudo pacman -S ncdu

Run analysis on the needed partition:

sudo ncdu /

You'll get an interactive text-based interface where you can navigate folders, see their size, and delete files directly from the program (key d). This significantly speeds up the process.

🗑️ Step 3: Cleanup — What Can Be Safely Deleted?

After analysis, you'll see the "culprits." Here are the main categories for cleanup.

1. Package manager cache and old software versions

For Debian/Ubuntu:

# Remove locally cached package files (.deb)
sudo apt-get clean

# Remove old, unnecessary dependencies
sudo apt-get autoremove --purge

# Show old kernels (don't remove the current one!))
dpkg -l 'linux-image*' | grep '^ii'
# Remove a specific old kernel (example)
sudo apt-get purge linux-image-5.4.0-42-generic

For RHEL/CentOS/Fedora:

# Clean yum/dnf cache
sudo yum clean all   # or sudo dnf clean all

# Remove old kernels (careful!)
package-cleanup --oldkernels --count=2
# Or manually: rpm -qa kernel | sort -V | head -n -2 | xargs sudo yum remove -y

For Arch Linux:

sudo pacman -Sc      # Clean cache of installed packages (old versions)
sudo pacman -Scc     # Clean ENTIRE cache (including current) — not recommended for performance

2. Application and system logs

Logs in /var/log can grow infinitely, especially if there are service errors.

# View log sizes
sudo du -sh /var/log/*

# Safely delete old compressed logs (e.g., .gz files older than 30 days)
sudo find /var/log -name "*.gz" -type f -mtime +30 -delete
# Delete old uncompressed logs (careful!)
sudo find /var/log -type f -name "*.log" -mtime +7 -exec truncate -s 0 {} \;

💡 Tip: It's better not to delete but archive old logs (gzip) or configure logrotate (usually already set up). Check the config in /etc/logrotate.conf and /etc/logrotate.d/.

3. Temporary files and user caches

# Clean /tmp (usually safe, but some files may be in use)
sudo rm -rf /tmp/* /tmp/.* 2>/dev/null

# Current user's cache (browsers, applications)
rm -rf ~/.cache/*

⚠️ Important: Don't delete files in /tmp and ~/.cache if you're unsure they aren't used by current processes. Better to reboot the system to clean /tmp.

4. Large files found via ncdu or find

Find files larger than 100 MB:

sudo find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | awk '{ print $5, $9 }' | sort -rh

Check if they can be deleted or archived. Common candidates:

• Database dumps (*.sql, *.sqlite).
• Docker images (/var/lib/docker/overlay2, /var/lib/docker/containers).
• Backup files (*.bak, *.backup).
• Virtual machine disks (*.qcow2, *.vmdk).

🛠️ Step 4: Specific Cases

Docker / Podman

Containers and images can take up huge amounts of space.

# View space usage
docker system df
# Clean unused data (images, containers, networks, volumes)
docker system prune -a --volumes
# Safer: only stopped containers and dangling images
docker container prune
docker image prune

Databases (MySQL/PostgreSQL)

Delete old binary logs (binlogs) or dumps.

• MySQL: PURGE BINARY LOGS BEFORE '2026-01-01 00:00:00'; (run in mysql client).
• PostgreSQL: Configure archive_cleanup_command or delete old files in pg_wal/pg_xlog.

Old Linux kernels

Keep only the currently loaded kernel and possibly one previous one for backup.

# For Ubuntu/Debian (find current kernel)
uname -r
# Remove ALL others via apt (see list from step 3.1)

🚨 Step 5: What to Do If Space Isn't Being Freed?

Sometimes df shows free space, but applications still fail with "no space." This could be due to:

1. Inode exhaustion: df -i. Solution — delete millions of small files (e.g., old sessions in /var/lib/php/sessions).
2. Root space reservation: In ext4, 5% is reserved for root by default. On a 1 TB disk, that's 50 GB regular users can't occupy, but df will show as used. Check tune2fs -l /dev/sda1 | grep 'Reserved block count'. Reduce with: sudo tune2fs -m 1 /dev/sda1 (leave 1%).
3. Open deleted files: A file is deleted but a process still holds its descriptor. Find with: lsof | grep '(deleted)'. Solution — restart or kill the process.

📈 Step 6: Prevention and Monitoring

To prevent recurrence:

1. Set up monitoring: Add to cron (e.g., /etc/cron.weekly/disk-check) a script:

   #!/bin/bash
   THRESHOLD=90
   df -H | grep -vE '^Filesystem|tmpfs|cdrom' | awk '{ print $5 " " $6 }' | while read output;
   do
     usep=$(echo $output | awk '{ print $1 }' | cut -d'%' -f1)
     partition=$(echo $output | awk '{ print $2 }')
     if [ $usep -ge $THRESHOLD ]; then
       echo "Warning: partition $partition is $usep% full on $(hostname)!" | mail -s "Disk Almost Full" admin@example.com
     fi
   done
   

2. Configure logrotate: Ensure it's active and compresses logs (compress), removes old ones (rotate 4).
3. Limit application log sizes: For nginx, apache, mysql, configure rotation in their configs.
4. Regularly clean cache: Add apt-get clean or yum clean all to weekly cron.
5. Use ncdu for periodic manual checks of "hot" spots: /var, /home, /usr.

❓ Frequently Asked Questions

Q: Can I just delete everything in /tmp?

A: In most cases yes, especially after a reboot. But if the system has been running long without reboot, some apps may store temporary files there. Better to delete only old files (find /tmp -type f -mtime +7 -delete) or reboot.

Q: After cleanup df shows free space, but apps still crash with "no space."

A: Check inodes (df -i). Also check if root-reserved space is occupied (see Step 5). Or if there are open deleted files (lsof | grep deleted).

Q: Is it safe to delete files in /var/lib/docker?

A: No, never directly! Use only Docker commands: docker system prune -a. Directly deleting files in /var/lib/docker will break containers and corrupt data.

Q: How to automatically delete old files in a folder?

A: Use find with cron. Example: delete files in /backup older than 30 days: find /backup -type f -mtime +30 -delete. Add to crontab (crontab -e): 0 2 * * * /usr/bin/find /backup -type f -mtime +30 -delete.

Q: Why does du show less space than df?

A: Because du doesn't account for:

• Files deleted but still open by processes.
• Root-reserved space (in ext4).
• Hidden system files (if not run with sudo and there are root-only accessible directories).

By completing this guide, you'll not only quickly resolve the "disk full" issue but also gain tools to prevent it in the future. The key principle: regular monitoring and understanding what occupies space on your server.