Read Disk Usage Before Deleting Anything

Snow-covered mountains disappearing into low clouds

A full filesystem encourages impatient commands. The safer first step is to separate three questions: which filesystem is full, which directory appears large, and whether deleted files are still held open.

Start with the filesystem view:

df -hT
df -ih

The first command reports space by mounted filesystem. The second reports inode use. A filesystem can have free bytes and still reject new files because millions of tiny files consumed all available inodes.

Once the mount point is known, inspect its top level without crossing into other mounted filesystems:

sudo du -xhd1 /var 2>/dev/null | sort -h

Repeat the command inside the largest directory. This is slower than guessing, but it preserves the evidence. On a busy server, run it with care because walking a large tree creates I/O.

For files rather than directories, use find with a deliberate boundary:

sudo find /var -xdev -type f -size +500M -printf '%s %p\n' \
  | sort -n \
  | tail -20

Do not delete the first large result automatically. A database file, active log, package cache, and abandoned archive need different handling.

When `df` and `du` disagree

If df reports used space that du cannot account for, look for deleted files still open by a process:

sudo lsof +L1

Removing a pathname does not release its blocks while a process still holds the file descriptor. Restarting or reloading the responsible service may release the space, but first understand what the process is and whether interruption is safe.

The goal of this pass is not cleanup. It is a short inventory that turns “the disk is full” into a specific statement such as “journald occupies 18 GB on /var” or “an unlinked application log remains open.” Cleanup becomes much safer after the sentence has a subject.

When df and du disagree

References

When `df` and `du` disagree