WIUNIX ACADEMY
Linux says disk full: distinguish blocks, inodes and deleted open files
Build a read-only evidence trail before cleanup: identify the filesystem, compare allocation and directory usage, and find the process retaining deleted data.
Make this guide yoursYOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment4 editable values
THE OUTCOME
What will you have at the end?
Build a read-only evidence trail before cleanup: identify the filesystem, compare allocation and directory usage, and find the process retaining deleted data.
Supported operating systems and versions
Primary-documentation review; no production execution or universal installation test is claimed. Examples assume existing tools on Linux and must be adapted to authorized deployment context.
Before you begin
- Authorized operator access, existing tools named in the panels, and a private place to retain diagnostic evidence.
- Use a staging environment or an approved read-only production investigation; review disruptive changes separately.
Do not start with deletion
ENOSPC may mean exhausted blocks, exhausted inodes, a filesystem-specific allocation limit or another layer such as a container writable layer. EDQUOT indicates a quota issue and EROFS a read-only mount; neither is repaired by randomly deleting logs. This guide investigates an existing Linux filesystem without changing mount, quota or reserve settings. It does not provide a universal cleanup list for application data.
LET’S BUILD
Check the selected distribution and required tools first
Run on the authorized diagnostic host or disposable lab VM. Compare the installed OS and required packages below with the selected path. Obtain missing tools from the distribution’s enabled official repositories through your approved package-management process; this workflow does not reinstall an existing server or switch its repository.
Ubuntu 26.10 is the reviewed default, with 26.04 LTS and 24.04 LTS alternatives. Check the actual package build and local configuration rather than assuming identical versions.
RPM names the ps package procps-ng. The df/du/lsof workflow is filesystem-neutral, but interpretation is not: ext4 reserved blocks do not describe XFS; quotas, snapshots and shared extents need filesystem-specific accounting. No repair, reserve adjustment or quota change is part of this workflow.
Authorized terminal on the host identified in this section
cat /etc/os-release
dpkg-query -W coreutils util-linux procps lsof
command -v df du findmnt ps lsof statRequired packages and tools are identified; resolve missing tools before continuing.
LET’S BUILD
Resolve the actual filesystem and its options
Run on the affected host. The selected path /var must already exist. Confirm its mount source, type and options before interpreting capacity. A nested mount can make a path belong to a different filesystem than its parent; a shell on the host can also see different mounts from an isolated container.
Authorized Linux terminal
test -d '/var' || exit 1
findmnt --target '/var' -o TARGET,SOURCE,FSTYPE,OPTIONS
df -hT -- '/var'
df -i -- '/var'Record filesystem source/type/options, available blocks and free inodes from the same target.
Choose the correct branch from the first measurements
If inode use is near its limit while bytes remain, investigate many small files. If allocated capacity is high but a bounded directory walk is much smaller, investigate deleted-open files, snapshots or data hidden beneath mount points. On Btrfs, ZFS, thin-provisioned storage and quotas, filesystem-native accounting is also required. A sparse file’s apparent length differs from allocated blocks, so do not compare incompatible size measures.
LET’S BUILD
Inspect one filesystem without crossing mounts
Start with /var, not an unbounded scan of every disk. The one-filesystem option avoids descending into other device mounts but does not make the scan free; use a quiet window for large trees. Errors such as permission denied or files disappearing during the walk make the total incomplete. The command reads metadata and can create significant I/O on large directories.
Authorized Linux terminal
sudo du -x -h --max-depth=1 -- '/var'Identify the largest relevant child on this filesystem while preserving all scan errors; do not redirect errors away and call the total complete.
LET’S BUILD
Count inode-heavy subtrees without sorting millions of filenames
If inode exhaustion is supported by the first check, compare inode counts one level down within the selected evidence-based subtree /var/log. This avoids building a giant filename list in a full temporary filesystem. Counts include directory entries and filesystem details; hardlinks and concurrent changes need interpretation. A large cache directory still requires its owning application’s retention rules before cleanup.
Authorized Linux terminal
sudo du -x --inodes --max-depth=1 -- '/var/log'The high-inode subtree is identified without deleting files or crossing into another filesystem.