Disk Cleanup in Linux: A Complete Guide to Freeing Up Space

Introduction / Why This Is Needed

Disk space on a Linux server or workstation can run out for various reasons: accumulation of package caches, growing logs, temporary files, old program versions, or orphaned files. Uncontrolled disk usage leads to system slowdowns, write errors, and even service failures. This guide will help you approach disk cleanup systematically, starting with analysis and ending with the safe deletion of unnecessary data. You will learn to use standard utilities and commands that work on most distributions.

Requirements / Preparation

Before you begin, ensure that:

1. You have terminal access with superuser (sudo) privileges to remove system files.
2. You know which data on the system is critical. When in doubt—make a backup of important directories.
3. Basic utilities are installed: df, du, find, sort. For advanced analysis, it is recommended to install ncdu (sudo apt install ncdu or sudo yum install ncdu).
4. If Docker is installed on the system, make sure the service is running (systemctl status docker).

⚠️ Important: Do not delete files in system directories (/bin, /sbin, /usr, /etc) unless you are sure of their purpose. This can lead to system failure.

Step 1: Analyzing Disk Space Usage

Before deleting anything, you need to understand what is consuming space.

Checking Free Space on Partitions

df -h

The df (disk free) command shows filesystem usage in a human-readable format (-h). Pay attention to the usage percentage (Use%) and mount point (Mounted on). If any partition is over 90% full, it is a priority for cleanup.

Finding Large Directories

sudo du -sh /* 2>/dev/null | sort -rh | head -n 20

du (disk usage) estimates directory usage. -s is summary, -h is human-readable. We check root directories (/*), redirect errors (e.g., "Permission denied") to /dev/null, sort in reverse (sort -rh), and take the top 20. This will show which directories are the largest.

Interactive Analysis with ncdu

If ncdu is installed, this is the most convenient method:

sudo ncdu /

The tool allows you to navigate directories, see sizes, and delete files directly from the interface (key d). Be careful: deletion from ncdu is irreversible.

Step 2: Cleaning the Package Manager Cache

Package managers store downloaded package archives, which are often unnecessary after installation.

For APT (Debian, Ubuntu, Mint)

sudo apt-get clean

Deletes all files from the cache (/var/cache/apt/archives). This is safe, but subsequent package installations will require re-downloading.

If you want to clean only obsolete package versions (frees less space):

sudo apt-get autoclean

For YUM/DNF (RHEL, CentOS, Fedora)

sudo yum clean all

or for DNF:

sudo dnf clean all

Deletes cache of metadata and packages from /var/cache/yum or /var/cache/dnf.

For Pacman (Arch Linux)

sudo pacman -Scc

Cleans the entire package cache. Be careful: you will not be able to roll back to previous package versions without re-downloading.

For Zypper (openSUSE)

sudo zypper clean

Step 3: Removing Old Kernels and Unused Packages

Linux systems often leave old kernel versions after updates. Each kernel occupies 100-300 MB.

For APT

sudo apt-get autoremove --purge

Will remove packages installed as dependencies but no longer needed, including old kernels. The --purge flag also removes configuration files.

If you need to remove a specific old kernel:

dpkg -l 'linux-image*'  # list installed kernels
sudo apt-get remove linux-image-5.4.0-XX-generic

For DNF/YUM

sudo dnf autoremove

or

sudo yum autoremove

For Pacman

sudo pacman -Rns $(pacman -Qdtq)

Removes orphaned dependencies (packages installed as dependencies but not required by any installed package). Be careful: the command may remove important packages if they were installed manually. Check the list before removal:

pacman -Qdtq

Step 4: Cleaning Temporary Files

Temporary files accumulate in standard directories and in user home directories.

Cleaning /tmp and /var/tmp

sudo rm -rf /tmp/*
sudo rm -rf /var/tmp/*

⚠️ Caution: Ensure no critical processes are using these directories. It is better to delete files older than 10 days:

sudo find /tmp -type f -atime +10 -delete
sudo find /var/tmp -type f -atime +10 -delete

Cleaning User Cache

For the current user:

rm -rf ~/.cache/*

For all users (requires sudo):

sudo rm -rf /home/*/.cache/*

Or use ncdu to analyze ~/.cache.

Step 5: Cleaning Logs

Logs in /var/log can grow, especially if applications write to them without rotation.

Deleting Old Compressed Logs

sudo find /var/log -type f -name "*.gz" -delete

Deletes compressed log archives (usually old, already rotated logs).

Cleaning Active Logs (Caution!)

sudo find /var/log -type f -name "*.log" -size +100M -delete

Deletes log files larger than 100 MB. Before deletion, check if they can be compressed (gzip) or rotated via logrotate.

Checking and Cleaning systemd Journal (if used)

sudo journalctl --disk-usage

Shows the current size of the systemd journal. Limit it:

sudo journalctl --vacuum-size=100M

Will delete old entries, leaving no more than 100 MB. Or by time:

sudo journalctl --vacuum-time=3d

Will keep entries from the last 3 days.

Step 6: Finding and Deleting Large Files

Sometimes space is taken by "forgotten" files: ISO images, archives, dumps.

Finding Files Larger Than N MB

sudo find / -type f -size +500M -exec ls -lh {} \; 2>/dev/null | awk '{ print $5, $9 }'

Searches for files larger than 500 MB and prints their size and path. Change +500M to the desired size.

Finding Large Directories (Alternative to du)

sudo du -a / 2>/dev/null | sort -n -r | head -n 30

Will show the top 30 largest files and directories on the entire system.

Deleting a Specific File

After finding a file, ensure it is not needed and delete it:

sudo rm -f /path/to/file

Step 7: Cleaning Docker (if installed)

Docker quickly fills disk with images, containers, and volumes.

Viewing Usage

docker system df

Shows space used by images, containers, volumes, and build cache.

Cleaning All Unused Objects

docker system prune -a

Will delete:

• All stopped containers
• Unused images (including dangling and unreferenced)
• Unused networks
• Build cache The -a flag also removes unused images, not just dangling ones.

Targeted Cleanup

docker image prune -a  # only images
docker container prune # only containers
docker volume prune    # only volumes

💡 Tip: Add --filter "until=24h" to delete only objects older than 24 hours.

Step 8: Additional Methods (as Needed)

Cleaning Browser Caches (for Desktop Systems)

• Firefox: rm -rf ~/.cache/mozilla/firefox/*.default/cache2/
• Chrome/Chromium: rm -rf ~/.cache/google-chrome/Default/Cache/
• Edge: rm -rf ~/.cache/microsoft-edge/Default/Cache/

Cleaning Flatpak/Snap Cache

flatpak uninstall --unused  # Flatpak
sudo snap set system refresh.retain=2  # Keep only the last 2 versions of snap packages

Cleaning Compiler Cache

sudo rm -rf /var/lib/apt/lists/*  # APT metadata cache (already removed in step 2, but can be recreated)
sudo rm -rf /usr/share/doc/*/  # package documentation (can take up a lot of space)

Verifying the Result

After all cleanups, check how much space was freed:

df -h

Compare with the initial data. Ensure critical partitions (e.g., / or /var) now have free space reserve (at least 10-15%).

Also check that services are running normally:

systemctl status --type=service --state=running

If any services have failed, you may have deleted their logs or lock files.

Possible Issues

1. "No space left" When Running Commands

Some commands (e.g., apt-get) require free space to operate. If space is completely exhausted:

• Delete the largest files found in step 6.
• Temporarily move large files to another partition or external disk.
• Increase the partition size (if possible).

2. Files Deleted but Space Not Freed

This happens if a file is open by a process (e.g., a log file you deleted but the process continues writing to it). Find such files:

sudo lsof | grep deleted

The output will have lines like:

COMMAND   PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
rsyslogd 1234   root    1w   REG    8,1   1024000 123456 /var/log/syslog (deleted)

Restart the process (e.g., sudo systemctl restart rsyslog), or reboot the system.

3. Important Files Deleted

If you accidentally deleted a system file:

• Restore from a backup.
• Reinstall the damaged package:

  sudo apt-get install --reinstall package
  

• As a last resort—recover from the installation media.

4. apt-get update Not Working After Cleaning Package Cache

Ensure you did not delete the metadata cache (/var/lib/apt/lists). If you did, run:

sudo apt-get update

5. Docker Fails to Start After docker system prune

If you deleted necessary networks or volumes, check container configurations. You may need to recreate containers:

docker-compose up -d  # if using docker-compose

Conclusion

Regular disk cleanup is an important part of Linux system maintenance. It is recommended to:

• Analyze disk usage once a month with ncdu.
• Configure automatic log rotation via logrotate.
• Limit package cache size (e.g., for APT: APT::Keep-Downloaded-Packages "0"; in /etc/apt/apt.conf.d/).
• For Docker hosts, set --data-root to a separate partition or use volume drivers.

These steps will help keep your system clean and avoid sudden disk space exhaustion.