Errno 28 means the filesystem that stores PHP sessions cannot create another file. That can mean the mount has run out of data blocks, or that it has exhausted its inode supply even though gigabytes remain free. Check both conditions on the mount containing PHP’s effective session.save_path, remove only safe expired session files, then repair cleanup or move sessions to a suitable writable store.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Start by identifying the path used by the web runtime, not just the PHP command-line configuration. Run df -h and df -i against that path, inspect session-file growth and other consumers, and verify a test login after recovery. Changing the path without fixing ownership, garbage collection, or inconsistent settings across workers only moves the failure.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat “No space left on device (28)” means in PHP
PHP’s file-based session handler creates a file for each session in the directory named by session.save_path. The PHP manual describes this setting as the argument passed to the save handler. When PHP calls session_start(), writes session data, or executes session_write_close(), the handler must create or update a file on that filesystem. Linux returns ENOSPC, commonly displayed as errno 28, when that operation cannot allocate storage.
There are two different resource failures:
- Block exhaustion: the filesystem has no free data blocks for file contents, directory entries, or metadata.
df -hnormally reveals this as a mount at or near 100 percent. - Inode exhaustion: the filesystem has no free inode structures for another file. A mount can report several free gigabytes while refusing every new session file when its inode pool is 100 percent used.
df -iexposes this condition.
A busy temporary directory is a common trigger because applications often leave file sessions in /tmp. Logs, caches, upload spools, package files, container layers, and deleted-but-still-open files can consume the same mount. The error identifies the failed allocation, not necessarily the largest directory, so measure the complete filesystem before deleting anything.
#1 Best Overall
- SPEED UP COMPUTER: The fanxiang 1TB SSD 2.5 Inch SATA SSD achieves blazing read and write speeds of 520MB/s, facilitating rapid file and data transfers
- UPGRADE YOUR COMPUTER: Compared to HDDs, the 1TB SATA SSD boots up at least 50% faster, enabling instant productivity or gaming sessions
- LONG-LASTING DURABILITY: The 2.5 SATA SSD 1TB incorporates 3D NAND TLC chips, offering a longer lifespan in writes compared to QLC, ensuring a more reliable data storage solution
- EXTENSIVE COMPATIBILITY: The S101 1TB SATA III SSD is compatible with desktops, laptops, all-in-one PCs, supporting various operating systems like Windows, Linux, and Mac OS, meeting the needs of diverse devices
- 3-Year Service: Fanxiang S101 1TB SSD solid state drive provides 3 years after-sales service and lifetime technical support. If you have any questions, please contact us and we will sincerely and professionally solve the problem for you
| Symptom | Likely resource | Confirmation |
|---|---|---|
df -h shows 100% use |
Data blocks | Check large files and directory totals on the affected mount |
df -h has room but df -i shows 100% use |
Inodes | Count small files, especially session files, cache entries, and mail spools |
| Both reports look normal but writes still fail | Wrong runtime path, quota, read-only mount, container limit, or a process holding deleted files | Inspect the effective PHP configuration, mount state, quotas, and open deleted files |
1. Identify the path PHP is actually using
Do not assume the path shown by a shell command is the one used by PHP-FPM or an Apache module. PHP can load different configuration files for the CLI and web SAPIs, and a pool or application can override the system value. A web diagnostic endpoint that runs in the same SAPI as the failing request is the most reliable check:
<?php
header('Content-Type: text/plain');
echo 'session.save_path: ', ini_get('session.save_path'), PHP_EOL;
echo 'session_save_path(): ', session_save_path(), PHP_EOL;
echo 'SAPI: ', PHP_SAPI, PHP_EOL;Call session_save_path() before session_start(). It returns the currently effective path and can also be used to set one. Remove the diagnostic endpoint after checking it, because configuration details should not be exposed publicly.
Recommended Free Tools
From a shell, the CLI value is still useful for comparison:
php -r 'echo PHP_SAPI, PHP_EOL, session_save_path(), PHP_EOL;'If the output differs from the web endpoint, troubleshoot the web SAPI’s configuration instead of changing the CLI php.ini. Review the PHP-FPM pool, virtual-host configuration, environment variables, and application bootstrap for calls that set a path at runtime.
Some session.save_path values contain optional semicolon-delimited arguments after the directory. Treat the first component as the directory and preserve the remaining options when interpreting the setting. Do not pass the entire string blindly to filesystem commands; extract the actual directory carefully and verify it exists.
2. Check both blocks and inodes on the affected mount
Once you know the real directory, run the checks against it. Using the path as an argument ensures you inspect the mount that contains it, even when the directory is not on the root filesystem.
Free tools Windows power users keep installed
One-click scans. No signup required.
df -h -- /path/from/session.save_path
df -i -- /path/from/session.save_pathOn systems whose df implementation does not accept the long option, omit --. The important distinction is the two reports: capacity in human-readable units and inode usage. Check every mount involved if the path is a symlink, bind mount, or container volume.
Also verify that the filesystem is writable and that the process has not hit a separate quota:
Rank #2
- High-Efficiency Performance: The SSD 1TB SATA adopts 3D NAND flash memory, which achieves a read speed of up to 560MB/s and a write speed of up to 510MB/s. Get a faster data transfer experience and improve your work efficiency.
- Upgrate Your Computer: The SATA 1TB SSD achieved faster app load and response times, and faster boot-up and shut-down, compared to HDDs. The internal SSD adopts advanced SLC Cache Technology, which improves overall computer performance.
- Reliability and Stability: The 2.5 SSD 1TB supports garbage collection, advanced wear-leveling technology, RAID, ECC, TRIM, and S.M.A.R.T, which makes the SATA SSD more reliable and stable. With the characteristics of shockproof, the SSD hard drive can keep your data safe, without worry even if your computer drops.
- Wide Compatibility: The 2.5'' SSD built-in SATA III 6Gb/S interfaces, witch backwards compatible with SATA II and SATA interfaces. The Internal SATA SSD is compatible with Windows, Linux, and Mac OS, and compatible with laptops, desktops, and all-in-one computers.
- 3-Year Service: Our SSDs come with a 3 years after-sales service and lifetime technical support. If you have any questions, please contact us and we will sincerely and professionally solve the problem for you.
findmnt --target /path/from/session.save_path
test -w /path/from/session.save_path && echo writable
quota -sfindmnt may not be installed, and quota output depends on the host. A read-only remount, an exhausted project or user quota, or a container’s overlay limit can produce a similar symptom even when the underlying disk appears healthy. In containerized deployments, run the check inside the affected container and on the host volume when you have access to both.
3. Find what consumed the blocks or inodes
Measure the session directory first, then its siblings on the same filesystem. The -x option prevents a directory traversal from crossing into another mount.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →du -xhd1 /path/from/session.save_path 2>/dev/null | sort -h
du -xhd1 /tmp 2>/dev/null | sort -h
find /path/from/session.save_path -xdev -type f -name 'sess_*' | wc -lThe first two commands identify large subdirectories; the file count identifies inode pressure from many small session files. A directory with modest byte usage can still exhaust inodes when it contains millions of entries. Use a representative sample to inspect ownership, age, and size:
find /path/from/session.save_path -xdev -type f -name 'sess_*' -printf '%TY-%Tm-%Td %TH:%TM %s %u %p
' | sort | head -n 50Session names and metadata differ by handler, so do not assume every file beginning with sess_ belongs to the same application without confirming the configured handler and directory. Check log directories, cache trees, upload temporary files, mail queues, and container writable layers as well.
A deleted file can continue consuming blocks while a process keeps it open. It will not appear in du, but the space returns when the last file descriptor closes. If available, list such files:
lsof +L1Restart or reload the owning service through the platform’s supported procedure after confirming that doing so is safe. Do not kill an arbitrary process merely because it has an open deleted file; identify the service and consider its request impact first.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Recover headroom without destroying active sessions
Free a small, known amount of space before attempting a broad fix. Keep the application’s retention and compliance rules in force. Removing every session file can log users out, invalidate carts or anti-forgery state, and interfere with an in-progress deployment.
Preview candidate session files
Choose an age that is safely beyond the application’s maximum session lifetime and any business requirement. The following example previews files older than one day; it is not a universal retention policy:
Rank #3
- THE SSD ALL-STAR: The latest 870 EVO has indisputable performance, reliability and compatibility built upon Samsung's pioneering technology. S.M.A.R.T. Support: Yes
- EXCELLENCE IN PERFORMANCE: Enjoy professional level SSD performance which maximizes the SATA interface limit to 560 530 MB/s sequential speeds,* accelerates write speeds and maintains long term high performance with a larger variable buffer, Designed for gamers and professionals to handle heavy workloads of high-end PCs, workstations and NAS
- INDUSTRY-DEFINING RELIABILITY: Meet the demands of every task — from everyday computing to 8K video processing, with up to 600 TBW** under a 5-year limited warranty***
- MORE COMPATIBLE THAN EVER: The 870 EVO has been compatibility tested**** for major host systems and applications, including chipsets, motherboards, NAS, and video recording devices
- UPGRADE WITH EASE: Using the 870 EVO SSD is as simple as plugging it into the standard 2.5 inch SATA form factor on your desktop PC or laptop; The renewed migration software takes care of the rest
find /path/from/session.save_path -xdev -type f -name 'sess_*' -mmin +1440 -print | head -n 100Confirm that the directory, filename pattern, ownership, and age match disposable sessions. If the application stores other data beside sessions, restrict the command to the verified session directory. Preserve the owner and group rules used by the PHP workers; avoid changing permissions as a side effect of cleanup.
Delete only confirmed expired files
After the preview is correct, remove the same set with a controlled command:
find /path/from/session.save_path -xdev -type f -name 'sess_*' -mmin +1440 -deleteUse a maintenance window or a rate-limited cleanup when the directory is extremely large. If the host provides a session-cleanup utility or scheduled task, prefer it over ad-hoc deletion because it may understand the platform’s ownership and naming rules. Rotate or truncate oversized logs through the service’s supported mechanism rather than deleting files that a daemon still has open.
Re-run both df -h and df -i after cleanup. If only a tiny amount of headroom returns, another directory, a quota, or open deleted files may be the real consumer.
5. Repair garbage collection and retention
Cleanup is temporary unless expired sessions are removed reliably. PHP’s request-time garbage collection is controlled by settings such as:
session.gc_maxlifetime = 1440
session.gc_probability = 1
session.gc_divisor = 100The values above are an example configuration, not a recommendation for every application. session.gc_maxlifetime is the age, in seconds, after which session data is eligible for collection. The probability and divisor determine how often a request triggers that work. Choose a lifetime that matches the application’s security and user-experience requirements, then verify the effective values in the same SAPI that serves traffic.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Some distributions disable request-time garbage collection and perform cleanup with a scheduled job instead. That job may cover the distribution’s default session directory but not an application-specific override. If you changed session.save_path, confirm that the scheduler, timer, or host cleanup service includes the new directory, runs under an account that can remove the files, and uses a retention period consistent with session.gc_maxlifetime.
Do not rely on a setting change alone to remove existing files. Run a safe one-time cleanup, deploy the corrected configuration, and watch the file count and oldest-file age over several cleanup cycles.
Rank #4
- 【Excellent Performance】Upgrade your laptop or desktop computer and feel the difference with super-fast operating system boot times and quick application loads. This SSD offers superior performance compared to traditional hard drives (HDD) and is perfect for gaming, delivering enhanced performance for seamless cutscenes.
- 【Multi-Scenario Use】The 7mm slim design of the Fikwot FX815 makes it suitable for Ultrabooks and Ultra-slim notebooks. Its large capacity options ranging from 256GB to 2TB cater to various storage needs, whether it be for office documents, entertainment files, or multimedia content.
- 【3D NAND Flash】The Fikwot FX815 adopting 3D NAND flash memory components, supporting mechanisms such as LDPC ECC error correction and intelligent SLC cache, configured with SATA 3.0 high-speed interface, the maximum read and write speed can reach 560 MB/s, 510 MB/s.（ssd internal hard drive）
- 【Long Life】The Fikwot FX815 is shock-resistant, vibration-resistant, and reduces noise interference, providing a durable and quiet storage solution.Enjoy extended battery life as this SSD consumes 45x less energy than a typical hard drive.（ssd hard drive internal）
- 【After-Sales Service】The Fikwot FX815 SSD comes with 3 years or 320 TBW (Terabytes Written) product maintenance, giving you peace of mind and reliable performance. The official website provides technical support and customer service.
6. Move sessions to a suitable filesystem when necessary
Relocation is appropriate when the current mount is intrinsically small, shared with volatile data, or repeatedly reaches its inode limit. Select a writable filesystem with sufficient blocks and inodes, predictable backup and restart behavior, and access for every PHP worker that needs the sessions.
Create and protect a dedicated directory
Create the directory using the account and group that actually run the PHP workers. The names below are examples; substitute the service account used by your server:
mkdir -p /var/lib/app-sessions
chown php-fpm:php-fpm /var/lib/app-sessions
chmod 0700 /var/lib/app-sessionsIf several local worker accounts must share it, use a dedicated group, set an appropriate group ownership and mode, and verify that new files inherit the required group. Keep permissions as restrictive as the application permits. A session file can contain authentication identifiers or personal data, so a world-readable temporary directory is a security risk.
Set the path before starting a session
<?php
session_save_path('/var/lib/app-sessions');
session_start();The call must happen before session_start() and before any code that causes the session to initialize. If the application sets the path in configuration, use that single source of truth rather than setting different values in individual controllers. Deploy the same effective path and permissions to every PHP worker and every web node that serves the application.
Plan the cutover
- Create the new directory and test that the PHP worker can create, read, update, and delete a file there.
- Configure the new path in the correct SAPI or application bootstrap, then reload workers using the normal deployment procedure.
- Test a fresh login, an existing session, and an explicit
session_write_close()call. - Keep the old directory temporarily if you need a controlled migration, but do not allow two independent stores to receive traffic indefinitely. Decide whether old sessions should expire naturally or be invalidated deliberately.
- Add the new directory to backups, monitoring, scheduled cleanup, and incident documentation where those controls are required.
Local, dedicated, and shared session stores compared
| Store | Blocks and inodes | Cleanup | Restart behavior | Multiple web nodes | Main risks |
|---|---|---|---|---|---|
| Default temporary directory | Competes with every user of that mount; inode exhaustion can arrive unexpectedly | Often depends on request-time GC or a host job that may not cover overrides | May be cleared during reboot or maintenance | Works only when all nodes share the same underlying store | Unrelated files, permissive access, and undocumented retention |
| Dedicated local filesystem directory | Capacity and inode budget can be monitored separately | Can be tied to a dedicated scheduled cleanup policy | Usually persists across service restarts; verify behavior across host reboots | Not shared automatically between nodes | Wrong owner, insufficient mount size, or inconsistent deployment |
| Shared or remote session handler | Moves pressure away from each web node but introduces limits and failure modes of the shared service | Centralized policy is possible, provided expiration is configured there | Depends on the remote service’s persistence settings | Designed for shared access when latency and availability are acceptable | Network failures, credentials, consistency, and a new capacity or inode bottleneck |
A larger disk addresses only block capacity. It does not fix inode exhaustion, a wrong path, disabled cleanup, bad permissions, or an undersized shared service. A faster disk likewise cannot make an unwritable directory usable.
7. Verify the repair
After freeing space or changing the path, verify the operation from the application’s point of view rather than relying only on shell commands.
- Open a private browser session and authenticate.
- Load a second page that reads the session, then perform an action that writes it.
- Exercise code that calls
session_write_close()if the application uses it. - Confirm that a new session file appears in the intended directory and that its owner and mode are correct.
- Repeat the test through every web node or pool that can receive the request.
- Recheck
df -h,df -i, session-file count, and oldest-file age after the next scheduled cleanup.
Keep alerts for both block and inode percentages. Also alert on session-directory file count and age, because those indicators can reveal a cleanup failure before the filesystem reaches 100 percent. Set thresholds that leave enough headroom for deployments, log rotation, and short traffic spikes; an alert at the point of failure is too late to protect logins.
Common failure modes and their fixes
Cleaning the wrong directory
The shell’s CLI configuration may point to one location while PHP-FPM uses another, or an application override may redirect sessions at runtime. Recheck session_save_path() in the web SAPI and run df against that exact path.
Best Value
- Boot up faster. Load files quicker. Improve overall system responsiveness
- 300% faster than a typical hard drive
- Improves battery life because it’s 45x more energy efficient than a typical hard drive
- Micron 3D NAND – advancing the world's memory and storage technology for 40 years
- Crucial 3-year limited warranty
Checking only disk bytes
If df -h is healthy but writes fail, inspect df -i and count files. Millions of tiny sessions or cache entries can consume every inode with little apparent byte usage.
Deleting active sessions indiscriminately
Mass deletion may log out every user and can violate retention requirements. Preview an age-filtered list, remove only confirmed expired files, and coordinate a full invalidation when security policy requires one.
Moving the path but leaving permissions wrong
A directory owned by the deployment account may be inaccessible to PHP workers, while a broadly writable directory exposes session data. Test create, read, update, and delete operations as the worker identity and apply the narrowest workable mode.
Garbage collection never reaches the custom path
A host scheduler may clean only the distribution’s default directory, or request-time collection may be disabled. Update the scheduler or timer to cover the override and verify it actually removes files older than the selected policy.
Only one node was changed
When traffic is load-balanced, inconsistent paths create intermittent logouts and write failures. Deploy the configuration, directory, ownership, cleanup, and monitoring to every node, or use a deliberately shared session store.
The space is held by deleted files
If directory totals do not explain the usage, inspect open deleted files with lsof +L1. Restart or reload the identified service through its supported process so the file descriptor closes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A container limit is full
Overlay or ephemeral container storage can reach its limit while the host has free capacity. Check the mount from inside the failing container, identify the writable volume, and move sessions to a properly sized persistent mount rather than assuming host-level free space is available.
When to escalate
Escalate to the hosting or infrastructure team when you cannot inspect the mount, quotas, container layer, or PHP worker identity; when the filesystem repeatedly returns to 100 percent after verified cleanup; or when a shared session service is failing. Provide the effective session path, outputs of df -h and df -i with sensitive names removed, session-file counts and age, the PHP SAPI, and the time of the failed request. That evidence distinguishes a capacity incident from a configuration, permission, or platform problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
