Disk Space Emergency? A Complete Linux Guide to Locate and Safely Delete Large Files

1. Quick Disk Diagnosis

Check overall partition health before deleting anything:

Run df -h and focus on the Use% column of the root ( /) or /home partitions. Example output shows a 92% used root partition.

Since df only reports partition totals, list the top‑consuming directories with: du -sh /* 2>/dev/null | sort -hr | head -10 Flags: -s (summary), -h (human‑readable), 2>/dev/null (ignore permission errors), sort -hr (size‑descending), head -10 (show ten largest).

For a specific directory such as /var:

du -sh /var/* 2>/dev/null | sort -hr | head -10

Interactive analysis with ncdu (install with apt install ncdu or yum install ncdu), then run ncdu /. Key bindings:

↑ ↓ – navigate

Enter – enter a directory

d – delete selected entry

q – quit

2. Precise Large‑File Location

Find files larger than 500 MiB:

sudo find / -type f -size +500M -exec ls -lh {} \; 2>/dev/null | sort -k5 -hr

Variants for common scenarios:

Search specific directories (e.g., /var and /home) for files >100 MiB: sudo find /var /home -type f -size +100M Locate large log files: find /var/log -type f -name "*.log" -size +50M Find core dumps >10 MiB: find / -type f -name "*core*" -size +10M Check Docker storage usage:

du -sh /var/lib/docker

3. Safe Deletion Practices

Verify a file is not in use: lsof /path/to/file.

Perform a soft delete by moving the file to /tmp/ and monitoring for a period: mv bigfile.log /tmp/ Use trash-cli for reversible deletion (install with apt install trash-cli):

trash-put file
trash-list
trash-empty

Confirm file type before removal: file suspicious_file.

4. Common Space Consumers

Log files : Check journal size with journalctl --disk-usage. Clean with either journalctl --vacuum-time=2d (keep two days) or journalctl --vacuum-size=200M (limit to 200 MiB).

Docker : View usage via docker system df. Remove unused images, containers, volumes with docker system prune -a -f --volumes.

Package manager caches :

Ubuntu/Debian: apt clean and apt autoremove.

CentOS/RHEL: yum clean all or dnf clean all.

Old kernels :

Ubuntu: apt autoremove --purge.

CentOS: package-cleanup --oldkernels --count=2.

User caches : Inspect with du -sh ~/.cache and clean with rm -rf ~/.cache/*.

Web server logs (e.g., Nginx): Truncate by redirecting an empty string:

> /var/log/nginx/access.log

5. Inode Exhaustion

Even with free space, a filesystem can report “No space left on device” when inodes are 100 % used. Check inode usage with: df -i Example shows IUse% 100%. Locate directories that contain many small files (inode hotspots) using:

find / -xdev -type f | cut -d/ -f2 | sort | uniq -c | sort -n

Typical hotspots include /tmp, /var/log, user cache directories, and mail queues.

6. Classic Pitfall: Deleted Files Still Open

Scenario: df -h reports 100 % usage while du -sh / shows a much smaller size. The cause is files that have been deleted but are still held open by a running process.

Identify such files with: lsof | grep deleted Example output: java 12345 root 10G /var/log/app.log (deleted) Resolution:

Restart the affected service: systemctl restart app.

Or send a HUP signal to the process: kill -HUP 12345.

7. Essential Disk‑Space Commands for Operations

du -h --max-depth=1 /

– show top‑level directory sizes. find / -type f -size +1G – locate files larger than 1 GiB. find /var/log -mtime -7 – list logs modified in the last 7 days. find /var/log -mtime +30 -delete – purge logs older than 30 days. truncate -s 0 logfile – truncate a log file to zero length. docker system prune -af – clean all unused Docker resources. ncdu / – interactive disk‑usage explorer.

8. One‑Click Disk Analysis Script (Ops Tool)

#!/bin/bash

echo "===== Disk Usage ====="
df -h

echo ""
echo "===== Top Directories ====="
du -h --max-depth=1 / | sort -hr | head

echo ""
echo "===== Top Files (>=500M) ====="
find / -type f -size +500M -exec ls -lh {} \; 2>/dev/null | head

echo ""
echo "===== Deleted Files Still Open ====="
lsof | grep deleted

Execute with bash disk-check.sh.

9. Production‑Level Disk Monitoring Tools

Prometheus – metric collection.

Grafana – visualization of metrics.

Zabbix – general ops monitoring.

Netdata – real‑time system monitoring.

10. Linux Disk‑Investigation SOP

Run df -h to view overall usage.

Run du -h --max-depth=1 / to identify large top‑level directories.

Run find / -type f -size +500M to locate huge files.

Run lsof | grep deleted to detect open deleted files.

Check key locations: /var/log, /tmp, /var/lib/docker, /home.

11. Real Production Incident

A server reported 100 % disk usage. df -h confirmed full usage, but du -sh / reported only 30 GiB used. Investigation with lsof | grep deleted revealed a Java process holding a 50 GiB deleted log file. Restarting the service freed space, reducing usage to roughly 40 %.

12. Final Takeaway

Master the four core commands— df (view disks), du (inspect directories), find (search files), and lsof (detect open deleted files)—to resolve about 90 % of disk‑space problems quickly.