Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
World desk10 min

How to Find What Is Filling Up Disk Space on a Linux VPS

A practical, safety-first workflow for finding what fills a Linux VPS: identify the full mount, distinguish blocks from inodes, drill into directories, resolve df/du mismatches and control journals, Docker data, logs and caches.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Start by identifying the full filesystem, then determine whether it is out of storage blocks or inodes. Use df -h, df -i and df -T first; rank directories with a filesystem-limited du scan; and investigate deleted files still held open when df reports substantially more usage than du. The workflow below covers the usual causes on Debian, Ubuntu and RHEL-family VPSs, including journals, Docker data, logs, package caches and old backups.

1. Confirm exactly what is full

Connect over SSH and use an account that can run sudo. Do not begin deleting files from whichever directory looks large: a separate /var, /boot or data partition may be full while the root filesystem still has free space.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Check storage blocks

df -h

df -h reports each mounted filesystem in human-readable units. Pay attention to the Mounted on column and the percentage in Use%. The filesystem at 100% is the one whose directories you must investigate. A VPS provider may expose a single root filesystem, but partition layouts vary.

Check inodes separately

df -i

Inodes track file and directory entries. A filesystem can have gigabytes free yet reject new files with No space left on device when its inode count is exhausted. Millions of tiny session files, mail-queue entries, cache objects or application-generated fragments are common causes. If IUse% is 100%, look for an excessive file count rather than one large file.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Show filesystem types and mount boundaries

df -T

This adds the filesystem type and helps reveal separate mounts. The boundary matters because a directory such as /var can be its own filesystem. A scan of / that crosses into another mount will not explain the usage of the full filesystem you are troubleshooting.

Capture a baseline before changing anything

  • Record the affected mount point, total size, used space and free space from df -h.
  • Record inode usage from df -i.
  • Note whether the error is storage exhaustion, inode exhaustion, or both.
  • Do not remove anything from /proc or /sys; those are virtual kernel filesystems, not ordinary storage to clean.

2. Rank top-level directories with du

Once you know the full mount, summarize its immediate children. For a full root filesystem, run:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo du -xh --max-depth=1 -x / | sort -h

The final lines are the largest directories. The -h option makes sizes readable, --max-depth=1 keeps the first report at one directory level, and -x prevents du from descending into other mounted filesystems. Keeping -x is the safer server default because it makes the scan comparable with the selected mount in df. Some guides omit it, which can make a root scan include unrelated disks or virtual mounts.

Run the same command again on the largest result. For example, if /var is largest:

sudo du -xh --max-depth=1 -x /var | sort -h

Continue down the largest branch, such as /var/log, /var/lib or /var/cache, until you reach the files or application data responsible. The apparent total from du will not always equal df: that discrepancy has a specific diagnostic path described below.

Scan another mounted filesystem directly

If df -T shows a separate mount, run du on that mount point with -x, not on the parent directory. For example:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo du -xh --max-depth=1 -x /home | sort -h

Replace /home with the actual mount shown by your system. This avoids mistaking a small directory entry on the root filesystem for the contents of the mounted filesystem.

Find unusually large individual files

After narrowing the directory, list large regular files without crossing filesystem boundaries:

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo find /var -xdev -type f -size +1G -printf '%s %pn' 2>/dev/null | sort -n

This example searches /var for files over 1 GiB and sorts by bytes. The exact threshold is a diagnostic choice, not a promise that every large file is disposable. Inspect ownership, age and the service using each file before acting. If your find implementation does not support -printf, use the directory-level du method instead.

3. Use an interactive view when a tree is easier to understand

ncdu provides a keyboard-driven directory tree and was designed for remote shells, making it practical over an SSH connection. Install it with your distribution’s package manager, then scan the affected mount:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
# Debian or Ubuntu
sudo apt update
sudo apt install ncdu

# RHEL-family distributions (package name may depend on enabled repositories)
sudo dnf install ncdu

# Scan the root filesystem without crossing mounts
sudo ncdu -x /

Use the arrow keys to enter the largest directory and return to its parent. The displayed totals are a convenient way to keep drilling into /var, /home, /opt or an application directory without repeatedly rewriting a command.

Be careful with the delete key: pressing d removes the selected item immediately after confirmation. Only delete an item when you have identified what created it, confirmed it is not needed for recovery or service operation, and checked whether the application has a supported cleanup or retention setting. A directory that is large is not automatically safe to remove.

4. Resolve the classic df-versus-du mismatch

If df -h reports much more used space than your complete du -x scan can explain, a process may still have an unlinked file open. This often happens when a large log is deleted or replaced while the service continues writing to its original file descriptor.

Unix removes a directory entry when a file is deleted, but the file’s data blocks remain allocated until every process closes its handle. Consequently, the file disappears from du while the space remains counted by df. The space returns only after the owning process closes the file.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

List deleted files that are still open

sudo lsof +L1

lsof +L1 lists open files whose link count is zero. Look for large sizes, identify the process and user, and note the file descriptor. A deleted log held by a web server, database, worker or monitoring daemon is a common finding.

Release the blocks safely

Use the service’s documented log-reopen, reload or rotation mechanism when one exists. A controlled restart of the owning service is the fallback when a reload cannot close the descriptor, but schedule it according to the service’s availability requirements. Do not indiscriminately kill every process shown by lsof; that can interrupt unrelated workloads or corrupt state.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Some operational guides suggest truncating a live log in place with truncate -s 0. Treat that as a service-specific option to verify first: truncation can discard records needed for auditing or incident analysis, and the correct handling depends on the daemon. Removing the pathname alone is not a fix while the descriptor remains open.

Run df -h again after the process has reloaded or stopped. The used-space figure should fall if the deleted file was the cause. If it does not, repeat the mount and inode checks rather than assuming the first candidate was responsible.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

5. Measure and control the systemd journal

On systems using systemd, archived journal files can consume substantial space under /var/log/journal. Ask journald for its current disk usage:

journalctl --disk-usage

To remove older archived entries while retaining recent history, rotate first and then vacuum:

sudo journalctl --rotate
sudo journalctl --vacuum-size=200M

--vacuum-size=200M removes archived journal files until their total is at most approximately 200 MB. A time-based alternative is:

sudo journalctl --rotate
sudo journalctl --vacuum-time=7d

Vacuuming removes archived files only; it does not delete the active journal file. Rotating first makes recent entries eligible for the cleanup. Choose a size or retention period that still satisfies your troubleshooting, audit and compliance needs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Prevent the same growth from returning

Set persistent limits in /etc/systemd/journald.conf, using the journald settings appropriate to your distribution and retention policy. After changing the configuration, reload or restart journald according to your system’s administration procedure, then verify with journalctl --disk-usage. A one-time vacuum frees space; a policy limit controls future growth.

6. Check Docker storage before pruning anything

If Docker is installed, its images, writable container layers, volumes and build cache may be the largest consumer under /var/lib/docker. Start with the summary:

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
docker system df

For per-object detail, use:

docker system df -v

Review the detailed output before cleanup. The broad command below removes stopped containers, unused networks, dangling images and build cache:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
docker system prune

Important scope details:

  • Plain docker system prune keeps volumes.
  • Passing --volumes also removes unused volumes, which may contain data you expected to retain.
  • Plain prune keeps unused tagged images; -a includes unused images that are not merely dangling.
  • Named unused volumes are not removed by plain system prune; docker volume prune targets them separately.

Because prune operations are destructive, confirm that no stopped container, image or volume is part of a rollback plan, development environment or backup workflow. If Docker is not installed or is not responsible for the full mount, do not run these commands just because they are available.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

7. Inspect the ordinary suspects under /var and /root

Logs that are not rotating

Inspect /var/log for a current log that has grown without rotation, compressed archives retained too long, or an application writing outside the distribution’s normal rotation rules. Identify the service, then fix its rotation or retention configuration instead of repeatedly deleting its active log.

Package caches

Package managers keep downloaded packages in cache directories. Confirm the cache’s size in your du results and use the package manager’s supported cache-cleaning command for your distribution. Do not remove package database files or arbitrary directories by hand.

Old kernels

Several installed kernels can occupy space in /boot and related package directories. Keep the running kernel and at least one known-good fallback. Determine the running version with:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
uname -r

Remove older kernels only through the distribution’s package manager, and never delete the files belonging to the kernel currently in use.

Backups, archives and application data

Look for dated tarballs, database dumps, deployment releases and user uploads in /var, /root, /opt and application-specific paths. Check timestamps, ownership and whether another system already stores a copy. A backup is not expendable merely because it is old; verify retention requirements before deleting it.

8. When the problem is inode exhaustion

With df -i at or near 100%, measure file counts rather than byte totals. A quick count for a suspected directory is:

sudo find /var -xdev -type f 2>/dev/null | wc -l

Repeat for likely branches such as session, queue, cache and mail-spool directories. This command counts files but not directories, so it is an indicator rather than a complete inode census. Once you identify the producer, use its retention setting, queue cleanup or supported purge process. Deleting arbitrary files from a live queue or session store can break applications even when it immediately restores inodes.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

After cleanup, recheck both df -i and df -h. Inode recovery and block recovery are related but distinct: deleting many tiny files may free inodes while changing the byte total only slightly.

9. A safe emergency sequence for “No space left on device”

When a production service is failing because the filesystem is full, prioritize a small, reversible amount of space so normal diagnostics can run. Keep an SSH session open while working; avoid broad deletion under pressure.

  1. Run df -h, df -i and df -T to identify the exact mount and failure type.
  2. If the root filesystem is full, run sudo du -xh --max-depth=1 -x / | sort -h; otherwise scan the full mount point directly.
  3. Check sudo lsof +L1 for deleted open logs when df is higher than du.
  4. Measure the journal with journalctl --disk-usage; rotate and vacuum only to a retention level you accept.
  5. If Docker is present, review docker system df -v and remove only objects you have approved.
  6. Inspect logs, caches, old kernels and backups in the largest directory; use supported service or package-manager cleanup mechanisms.
  7. Re-run all three df checks and confirm that the affected service can create files before closing the incident.

Do not delete files from /proc, /sys or core system directories to create emergency space. If the filesystem remains full after a suspected deleted file is released, return to the mount list: a different partition, bind mount or inode limit may be the real constraint.

10. Prevent the next disk emergency

  • Configure log rotation and verify that rotated files are actually compressed and expired.
  • Set journald size or time limits in /etc/systemd/journald.conf.
  • Define Docker image, build-cache and volume retention, and review docker system df -v periodically.
  • Set application limits for sessions, queues, uploads, temporary files and generated reports so millions of small files cannot accumulate.
  • Document backup retention and monitor the directory where local backups are written.
  • Alert on both filesystem percentage and inode percentage; either can prevent writes first.
  • Keep a record of mount points and expected capacity so a newly attached or separately mounted filesystem is not mistaken for the root disk.

The reliable cross-check is always the pair: df tells you what the filesystem has allocated, while filesystem-limited du explains which visible directories account for it. When they disagree, investigate open deleted files, mount boundaries and filesystem metadata instead of deleting random files.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Frequently Asked Questions

Why does df -h show a full disk when du finds no large file?

A process may still hold a deleted file open. Run sudo lsof +L1, then use the owning service’s log-reopen mechanism or perform a controlled restart so the file descriptor closes.

Can I delete everything reported by ncdu?

No. ncdu can delete immediately with d, but large directories may contain active logs, databases, queues, backups or Docker volumes. Confirm ownership, retention requirements and a supported cleanup method first.

What should I do if disk space is available but Linux still says “No space left on device”?

Check df -i. Exhausted inodes, often caused by millions of tiny files, can block new files even when df -h shows free storage.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.