Objective
Recover space on a saturated Linux filesystem without deleting files blindly by checking blocks and inodes, du results, deleted-but-open files, journald and application logs, Docker usage, quotas, and the long-term cause.
- Do not remove files, packages, containers or logs blindly to regain space or stop a restart loop.
- Capture service status and journal output before restarting repeatedly.
- Record the current state before making a production change and keep a tested rollback path.
- Change one variable at a time. Preserve timestamps, logs and configuration evidence so the result can be explained afterward.
- Use a pilot scope whenever possible and avoid broad service restarts, policy relaxations or destructive cleanup as a first diagnostic step.
Prerequisites
- Root or sudo access and the service, filesystem, container or timer name.
- A backup or configuration copy when the procedure changes persistent service state.
- Administrative access appropriate to the system being changed or diagnosed.
- A clearly identified scope: affected users, systems, addresses, services and the time of the observed problem.
- A maintenance or test window when the procedure can affect production traffic or availability.
- A copy of the current configuration or other recovery material before any irreversible action.
Step-by-step procedure
Establish the baseline and scope
Before changing anything, reproduce the issue or document the requested change on a representative system. Record the affected users or services, exact time, current configuration, recent changes and a known-good comparison point. This baseline is the reference used to decide whether each later step improves the situation.
- The scope and current state are documented well enough to reproduce or verify the procedure.
Blocks
Examine this diagnostic area: blocks. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Inodes
Examine this diagnostic area: inodes. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Du results
Examine this diagnostic area: du results. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Deleted-but-open files
Examine this diagnostic area: deleted-but-open files. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Journald
Examine this diagnostic area: journald. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Application logs
Examine this diagnostic area: application logs. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Docker usage
Examine this diagnostic area: Docker usage. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Quotas
Examine this diagnostic area: quotas. Use the narrowest reproducible test, compare the observed state with the documented or expected state, record timestamps and exact errors, and correlate the result with adjacent dependencies. Do not change several settings at once: the purpose of this step is to establish whether this area is healthy, misconfigured, unavailable, or simply not involved in the failure.
- Evidence for this area is explicit, reproducible and consistent with the intended design.
Validate the complete service
Repeat the original user, system or application workflow from the real source and verify the complete result, not only one command or one local check. Confirm that logs and monitoring show the expected behavior and that no temporary debug, bypass, test account, rule or maintenance setting remains enabled.
- The end-to-end service works or the remaining failure is isolated to a clearly identified component.
Technical commands from the original procedure
These technical blocks are preserved byte-for-byte from the historical procedure and kept in their original order. Review names, addresses, paths and parameters before use.
Technical block 1
df -hTTechnical block 2
df -iTechnical block 3
findmntTechnical block 4
sudo du -xhd1 /var 2>/dev/null | sort -hTechnical block 5
sudo du -xhd1 / 2>/dev/null | sort -hTechnical block 6
sudo lsof +L1Technical block 7
journalctl --disk-usageTechnical block 8
sudo du -sh /var/log/* 2>/dev/null | sort -hTechnical block 9
sudo logrotate -d /etc/logrotate.confTechnical block 10
sudo journalctl --vacuum-time=30dTechnical block 11
sudo journalctl --disk-usageTechnical block 12
docker system df -vTechnical block 13
sudo du -sh /var/lib/docker/* 2>/dev/null | sort -hTechnical block 14
sudo find /var/tmp -xdev -type f | wc -lTechnical block 15
sudo find /tmp -xdev -type f | wc -lTechnical block 16
lsblk -fTechnical block 17
sudo pvs; sudo vgs; sudo lvsValidation
The procedure is validated when:
- The original symptom or change request has been tested end to end.
- The effective configuration matches the intended design and no unexplained error remains in the relevant logs.
- Temporary troubleshooting controls have been removed and monitoring remains normal.
- The result, evidence and any follow-up action are documented.
Rollback
- Restore the configuration, policy, binding, route, credential assignment or service state recorded in the baseline when the change does not meet its success criteria.
- Remove temporary rules, test objects and diagnostic settings that were introduced only for the procedure.
- After rollback, repeat the minimum health checks to confirm that the previous service level has been restored.
Troubleshooting / common errors
- A deleted file can still consume disk space while held open by a process.
- Systemd and container restart policies can hide the first meaningful failure; inspect the earliest relevant log entry.
- If the result changes between tests, compare source, destination, identity, time and policy context before changing additional settings.
- If a command succeeds but the application still fails, continue at the next protocol or application layer instead of widening access.
- If the expected evidence is missing, verify that logging, auditing and the test path actually cover the failing component.
- If the change does not improve the measured symptom, restore the previous state and reassess the working hypothesis.
Official and vendor references preserved from the original procedure
- https://www.gnu.org/software/coreutils/manual/html_node/df-invocation.html
- https://www.gnu.org/software/coreutils/manual/html_node/du-invocation.html
- https://www.freedesktop.org/software/systemd/man/latest/journalctl.html
- https://docs.docker.com/reference/cli/docker/system/df/
Adapt names, addresses, paths and parameters to your environment. Back up the configuration and test on a limited scope first.