Home / Blog / Linux High Disk Usage Troubleshooting: du, df, Logs, Caches and Cleanup

Linux high disk usage troubleshooting guide banner
Disk usage troubleshooting

Linux High Disk Usage Troubleshooting Guide

If a Linux server is running out of disk space, you need to identify which filesystem is full, which directories are growing, and whether logs, backups, cache files or deleted-but-still-open files are responsible. This guide walks through a practical workflow using df, du, find and a few safe cleanup checks.

Linux Troubleshooting Hub cPanel Log Locations Backup Guide
On this page
Check full filesystems Find large directories Find large files Common causes Deleted open files Safe cleanup cPanel notes Common mistakes
Step 1

Check which filesystem is full with df

Start with df -h. This tells you whether the root partition, /var, /home or another filesystem is the problem.

df -h
$ df -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda2        80G   74G  2.1G  98% /
/dev/sda1       1.0G  242M  782M  24% /boot
tmpfs           3.8G     0  3.8G   0% /dev/shm
/dev/sdb1       250G  112G  126G  48% /backup
Tip: if / is full, the real culprit is often under /var, /home, /tmp or a growing backup directory.
Step 2

Find large directories with du

Once you know which filesystem is full, use du to locate the largest directories. Work top-down rather than diving in blind.

du -h --max-depth=1 / | sort -h
du -h --max-depth=1 /var | sort -h
du -h --max-depth=1 /home | sort -h
$ du -h --max-depth=1 /var | sort -h
12M   /var/tmp
210M  /var/cache
1.2G  /var/log
4.7G  /var/lib
6.2G  /var

If /var/log is huge, go to log rotation and old logs. If /var/cache is huge, check package manager cache, application cache or web cache. If /home is huge on cPanel servers, check account usage, domlogs, backups and old archives.

Step 3

Find large files with find

Use find when you need the exact files consuming space.

find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null
find /var/log -type f -size +100M -exec ls -lh {} \; 2>/dev/null
find /home -type f -name "*.tar.gz" -o -name "*.zip" -o -name "*.sql"
$ find /var/log -type f -size +100M -exec ls -lh {} \; 2>/dev/null
-rw-r----- 1 root adm 145M May  3 09:20 /var/log/messages
-rw-r--r-- 1 root root 612M May  3 08:58 /var/log/maillog
-rw-r--r-- 1 root root 228M May  3 09:01 /var/log/httpd/error_log
Common causes

What usually fills Linux disks?

Logs

Large Apache, PHP, mail or application logs. On cPanel, domlogs can grow quickly.

Backups

Old tar archives, database dumps and duplicate backups under /home or /backup.

Cache and temp data

Package manager cache, app cache, image cache, temporary export files and failed update leftovers.

Mail queues

Large mail spools or queue build-up on busy or problematic mail servers.

Databases

Huge database files or binary logs under /var/lib/mysql.

Deleted open files

A file can be deleted but still consume space if a process still has it open.

Often missed

Check for deleted files still being held open

If you deleted a large log but disk space did not return, a process may still have that file open.

lsof | grep deleted
lsof | grep '/var/log'
$ lsof | grep deleted
httpd   2715 apache   4w   REG  8,2 2147483648  0 123456 /var/log/httpd/error_log (deleted)
php-fpm 3121 apache   5w   REG  8,2  524288000  0 123457 /var/log/php-fpm/www-error.log (deleted)

In this case you normally restart the affected service after confirming it is safe:

systemctl restart httpd
systemctl restart php-fpm
Cleanup

Safe cleanup ideas

  • Remove clearly obsolete backups and archives after verifying you have another copy.
  • Rotate or truncate runaway logs only if you understand the service using them.
  • Clean package cache if appropriate, for example dnf clean all or apt clean.
  • Delete temporary exports, old cache files and staging copies that are no longer needed.
  • Fix the root cause so the disk does not fill again next week.
# examples, review before running
dnf clean all
journalctl --vacuum-time=7d
find /tmp -type f -mtime +7 -ls
find /var/tmp -type f -mtime +7 -ls
Do not blindly delete: database files, random files in /var/lib, live application files, or anything you have not identified. “Freeing space” by deleting the wrong thing is an exciting way to create a second ticket.
cPanel servers

Disk usage checks on cPanel servers

On cPanel servers, common space hogs include account home directories, domlogs, account backups, mailboxes, caches and old archives.

du -h --max-depth=1 /home | sort -h
du -h --max-depth=1 /usr/local/apache/domlogs | sort -h
find /home -type f \( -name "*.tar.gz" -o -name "*.sql" -o -name "*.zip" \) -exec ls -lh {} \; 2>/dev/null

Useful related pages:

Common mistakes

Mistakes to avoid

  • Checking du on the wrong mount point and missing the real full partition.
  • Deleting a log file without restarting the process holding it open.
  • Removing backups before confirming they exist elsewhere.
  • Running broad rm -rf commands in panic mode.
  • Fixing the symptom but not the root cause, such as log growth, bot traffic or failed backup rotation.
Related

Useful next steps

Linux Troubleshooting Hub cPanel Log Locations Search Logs for Errors systemd Guide Backup Automation Guide
Cleanup safety

Disk cleanup safety checklist

# Confirm which filesystem is full
df -h

# Find large directories on the same filesystem
du -xhd1 / | sort -h

# Find large files
find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null

# Check deleted files still held open
lsof +L1
Do not delete blindly from system paths. Identify the owner, purpose and recovery impact before removing files.
FAQ

Frequently Asked Questions

What command shows disk usage on Linux?

df -h shows filesystem usage, while du shows directory and file usage.

How do I find large files on Linux?

Use find with -size, for example find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null.

Why is disk space still full after deleting files?

A process may still have deleted files open. Check with lsof +L1.

Is it safe to clear log files?

It depends. Confirm the log purpose first and prefer log rotation or truncation over deleting important active files.

$ practise_next --topic find

Practise this next

Turn the guide into practice with a related quiz, builder, cheat sheet or learning path.

[1]Use the Find Command BuilderBuild find commands for names, sizes, dates and permissions.[2]Take the Find QuizCheck your find command knowledge.[3]Open the Find Cheat SheetReview useful find examples quickly.[4]Read: Mastering the Find CommandGo deeper into practical find examples.