Disk Full on Linux — How to Find and Fix Space Issues in 60 Seconds

The Problem Every Engineer Faces

Your monitoring alerts fire: disk usage at 90%. You SSH into the server. Now what? Knowing which commands to run and what their output means is the difference between a 2-minute fix and a 30-minute scramble.

This guide covers the three essential tools for disk space analysis in Linux.

df — Check Filesystem Disk Usage

The df command shows how much space is used and available on each mounted filesystem.

# Human-readable disk usage for all mounted filesystems
df -hT

# Check only a specific mount point
df -h /var

# Show only ext4 and xfs filesystems (skip tmpfs noise)
df -hT -t ext4 -t xfs

Reading df output

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/xvda1     xfs    50G   42G  8.0G  84% /
/dev/xvdf      ext4  100G   67G   33G  67% /data

Key columns: Use% tells you the urgency. Above 85% on root filesystem means you need to act.

What df cannot tell you

df shows filesystem-level usage but not which files or directories are consuming space. For that, you need du.

du — Find What's Using Space

The du command calculates disk usage per directory.

# Top 20 largest directories from root
du -sh /* 2>/dev/null | sort -rh | head -20

# Drill into /var to find the culprit
du -sh /var/* 2>/dev/null | sort -rh | head -10

# Find usage in a specific directory with depth limit
du -h --max-depth=2 /var/log | sort -rh | head -20

Production pattern: finding the bloat

Most disk-full situations in production come from:

# Check log directory sizes
du -sh /var/log/* | sort -rh | head -10

# Check Docker storage
du -sh /var/lib/docker/*

# Check container overlay storage
du -sh /var/lib/docker/overlay2/* 2>/dev/null | sort -rh | head -5

# Check journal logs
journalctl --disk-usage

ncdu — Interactive Disk Usage Analyzer

ncdu (NCurses Disk Usage) provides a visual, interactive interface for exploring disk usage.

# Install ncdu
apt install ncdu    # Debian/Ubuntu
yum install ncdu    # RHEL/CentOS

# Scan from root
ncdu /

# Scan a specific directory
ncdu /var/log

# Export scan results for later analysis
ncdu -o /tmp/scan.json /
ncdu -f /tmp/scan.json    # Load saved scan

ncdu lets you navigate directories with arrow keys and delete files directly. Essential for emergency disk cleanup.

Finding Large Files Directly

Sometimes you need to find specific large files:

# Find files larger than 100MB modified in the last 7 days
find / -type f -size +100M -mtime -7 -exec ls -lh {} \;

# Find the 20 largest files on the system
find / -type f -exec du -h {} + 2>/dev/null | sort -rh | head -20

# Find files deleted but still held open (invisible space usage)
lsof +L1 | grep deleted

The last command is critical — a process can hold a deleted file open, consuming disk space that du won't show. The fix is restarting the process holding the file descriptor.

Emergency Cleanup Procedures

When disk is at 95%+ and services are failing:

# 1. Clear package manager cache
apt clean                          # Debian/Ubuntu
yum clean all                      # RHEL/CentOS

# 2. Truncate large log files (don't delete — breaks logging)
truncate -s 0 /var/log/large-app.log

# 3. Remove old journal logs
journalctl --vacuum-size=200M

# 4. Docker cleanup (recovers GB in production)
docker system prune -af --volumes

# 5. Remove old kernels (Ubuntu)
apt autoremove --purge

Monitoring Disk Usage Proactively

Prevent emergencies by monitoring before they happen:

# Simple cron-based alert (add to crontab)
/10    * df -h / | awk 'NR==2 {gsub(/%/,"",$5); if($5 > 85) print "DISK WARNING: "$5"%"}' | mail -s "Disk Alert" ops@company.com

# Check inode usage (can run out before disk space)
df -i

Inode exhaustion is a sneaky failure mode — you have free disk space but cannot create new files because all inodes are allocated. This happens with millions of small files (like email queues or session files).

Quick Reference

Summary

Start with df -hT for the overview, du -sh to drill down, and find or lsof for specific culprits. In production, Docker storage and application logs are the most common space consumers. Set up monitoring alerts at 80% to avoid emergency situations.

---

Frequently Asked Questions

How do I check disk space on Linux?

Use df -h to see disk usage for all mounted filesystems in human-readable format (GB/MB). For specific directories, use du -sh /path/to/directory. To find the largest directories, use du -h --max-depth=1 / | sort -hr | head -20. The -h flag converts bytes to human-readable units.

What is the difference between df and du commands?

df (disk free) shows filesystem-level usage — total size, used space, available space, and mount points. du (disk usage) shows the actual space used by specific files and directories. df can show more used space than du finds because of deleted-but-open files still holding disk space. When they disagree, restart services or use lsof +D to find open deleted files.

How do I find what is filling up my disk in Linux?

Start with df -h to identify which filesystem is full, then use du -h --max-depth=1 /var | sort -hr to drill down into large directories. Common culprits are log files (/var/log), package caches (/var/cache), Docker images (/var/lib/docker), and temp files. Use find / -type f -size +100M to find individual large files.

How do I free up disk space quickly on Linux?

Clear package caches with apt clean or yum clean all, remove old log files with journalctl --vacuum-time=3d, clean Docker with docker system prune -a, and delete old kernels with apt autoremove. Check /tmp and application temp directories. For immediate relief, find and compress or delete the largest files identified by du.

---

Related Resources

• Linux Commands Reference — 50+ Linux commands with production examples
• DevOps Interview Academy — Linux interview questions
• Linux Performance Troubleshooting — Comprehensive performance diagnosis
• Linux Process Management Guide — Finding processes consuming disk I/O
• Monitoring and Alerting in Production — Alerting on disk utilization thresholds