IT Toolbox
Guide

How to find what fills a Linux drive

It is necessary to distinguish space saturation, saturation in inodes and deleted files still open before cleaning a Linux server.

TopicLinux →
⌚ About 2 min read
View my favorites
Linux Intermediate. 10 min

It is necessary to distinguish space saturation, saturation in inodes and deleted files still open before cleaning a Linux server.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Measuring volumes

    Use df -h to locate the saturated file system.

  2. 2

    Check for inodes

    Use df -i to exclude a lack of,inodes.

  3. 3

    Search for large folders

    Use from the assembly point concerned.

  4. 4

    Search for deleted open files

    lsof can reveal large files still occupied by a process.

  5. 5

    Clean in a targeted manner

    Treat logs, caches or data only after identification.

Commands utiles

df -h
df -i
sudo of -xhd1 /var, sort -h
sudo lsof +L1

À retenir

  • Do not blindly delete /var/lib or files from a database.
  • A deleted but still open file continues to occupy disk space.
  • Check Logrotate if the logs are the recurring cause.
← All les guides
Technical deep dive

Linux storage: distinguish blocks, inodes and deleted-but-open files

Technical checkpoints

  • df measures filesystem space while du measures visible files; a large gap can come from deleted files still held open.
  • df -i detects inode exhaustion, which can prevent file creation even with GBs free.
  • A filesystem remounted read-only may be kernel protection after I/O/filesystem errors; remounting rw without understanding the cause is risky.

Storage triage

Compare blocks, inodes, large directories and deleted files still open.

df -hT
df -i
du -xhd1 /var | sort -h
lsof +L1

Topic-specific pitfalls

  • Running rm under /var/lib or Docker without identifying data ownership can break services.
  • fsck should not be run on a filesystem mounted read-write except in specific documented cases.

How to validate

  • The cause of consumption or read-only transition is identified in logs/kernel.
  • After remediation, blocks and inodes have headroom and no new I/O errors appear.
♡ 0