finding what's eating disk on linux

2026-01-28

A server's disk fills up. You SSH in. df -h shows the partition is at 98%. What now?

step 1: confirm where

df -h

Look for the mount point that's full. Usually / or /var. If it's /tmp, someone left a junk file there and a reboot might fix it — but don't reboot yet.

step 2: find the heavy directories

du -h --max-depth=1 / 2>/dev/null | sort -hr | head -20

This gives you the top-level culprits. Follow the biggest one down a level:

du -h --max-depth=1 /var 2>/dev/null | sort -hr | head -20

step 3 (better): ncdu

If you can install packages, apt-get install ncdu and run ncdu /. It's an interactive disk usage browser. Navigate with arrows, d to delete. I've solved a full disk in 30 seconds with this.

common culprits

logs: /var/log/. journalctl, nginx, cron logs piling up. journalctl --vacuum-size=200M is the clean fix.
docker: docker system prune -a if you're sure nothing valuable is cached.
package cache: apt-get clean on Debian/Ubuntu.
deleted-but-held-open files: a process kept a file open when it was deleted. lsof +L1 lists them. Restart the process to release the space.

the trap

If du shows less than df, it's almost always the open-file-handle case above. Don't delete random things — find the process.