Linux Disk Space: Find What Is Full Before You Delete Anything
A “disk full” warning is a filesystem question first. Identify the full mount, then find the responsible data before deleting anything.
Short answer
When Linux reports a full disk, first identify which filesystem is full with df, then locate large directories or files with tools such as du. Do not start by deleting logs, caches or files from /var until you know why they grew and whether a service still needs them.
Use the tool that answers the right question
| Tool | Question answered | Common misunderstanding |
|---|---|---|
df -h | How full are mounted filesystems? | It does not tell you which visible directory is consuming the space. |
du -xhd1 PATH | How much visible space do directories below PATH use on one filesystem? | Permissions can hide data unless you have access. |
lsblk -f | Which block devices, filesystems and mount points exist? | It does not measure directory-level usage. |
journalctl --disk-usage | How much disk the systemd journal currently uses. | Journal use can be legitimate; limit it through supported configuration, not random file deletion. |
Why df and du can disagree
One common cause is a process holding an open file that has been deleted from the directory tree. du can no longer see the path, but the filesystem still accounts for the blocks until the process closes the file. Filesystem reservations, snapshots and permissions can also affect what each command reports.
Clean deliberately
Package caches, old downloads, container images and rotated logs can all be legitimate cleanup targets, but the supported command differs by distribution and application. Prefer the package manager or application’s cleanup mechanism so metadata stays consistent.
Useful gear for this task
Optional tools that fit the workflow above. Affiliate links may earn us a commission.
Frequently asked questions
What is the difference between df and du?
df reports filesystem-level space usage, while du measures space used by files and directories it can see. They answer different questions and can disagree for legitimate reasons such as deleted files still held open by a process.
What should I delete when Linux says the disk is full?
Do not start with broad deletion commands. Identify which filesystem is full, locate the largest consumers, check logs and package caches, and determine whether the growth is expected before removing anything.
Technical references checked
Technical review: 9 September 2026. Distribution, hardware and training details can change; recheck first-party documentation before a risky system change or purchase.