How to Fix a Full Disk on Linux

Symptoms of a Full Disk

When a Linux disk fills up you'll see errors like "No space left on device", applications crash, logs stop writing, and databases refuse to accept new data. Here's how to diagnose and recover quickly.

Step 1 — Identify Which Filesystem Is Full

df -h

Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        50G   50G     0 100% /
/dev/sdb1       200G  100G   90G  53% /data

The Use% column shows the culprit. Look for 100% (or 99%+).

Step 2 — Find the Largest Directories

du -sh /* 2>/dev/null | sort -rh | head -15

This shows the top 15 largest directories at the root level. Drill down into the biggest ones:

du -sh /var/* 2>/dev/null | sort -rh | head -10
du -sh /home/* 2>/dev/null | sort -rh

Step 3 — Find the Largest Individual Files

find / -type f -size +100M 2>/dev/null | sort

Or use find with du for sizes:

find /var -type f -size +50M -exec du -sh {} ; 2>/dev/null | sort -rh

Common Culprits and How to Fix Them

Old log files

sudo journalctl --disk-usage            # see how much the journal uses
sudo journalctl --vacuum-size=500M      # trim journal to 500 MB
sudo journalctl --vacuum-time=7d        # keep only 7 days of logs
sudo truncate -s 0 /var/log/large.log  # clear a specific log file

Package cache

sudo apt clean                 # remove all cached .deb packages
sudo apt autoremove            # remove unused dependency packages

Docker taking over

docker system df               # see Docker disk usage
docker system prune -a         # remove unused images, containers, volumes

Large files in /tmp

sudo rm -rf /tmp/*             # clear temp files (safe to do)

Old kernel versions

sudo apt autoremove --purge    # remove old kernels on Debian/Ubuntu

Monitor Disk Usage Over Time

watch -n 10 df -h              # refresh df every 10 seconds
ncdu /                         # interactive disk usage browser (install: sudo apt install ncdu)

Prevention

• Set up log rotation with logrotate
• Configure systemd journal size in /etc/systemd/journald.conf: SystemMaxUse=500M
• Add a disk usage cron alert: df -h | mail -s "Disk report" you@example.com