Disk Usage and Cleanup

# Human-readable sizes — the most common form
df -h

# Include filesystem type in the output
df -hT

# Show a specific path's filesystem usage
df -h /var/log

# Show inode usage instead of block usage (critical for inode exhaustion diagnosis)
df -i

# Exclude tmpfs and other virtual filesystems — show only real disks
df -hx tmpfs -x devtmpfs

# Show total size of a directory and all its contents
du -sh /var/log

# Show sizes of all immediate subdirectories — one level deep
du -h --max-depth=1 /var/log

# Sort directories by size — largest at the bottom
du -h --max-depth=1 /var | sort -h

# Sort directories by size — largest at the top (most useful for cleanup)
du -h --max-depth=1 /var | sort -rh | head -20

# Show size of every file in a directory recursively, sorted largest first
du -ah /var/log | sort -rh | head -20

# Summarise total usage for multiple paths
du -sh /var/log /var/cache /tmp /home

# Find files larger than 1GB anywhere on the system
sudo find / -xdev -size +1G -ls 2>/dev/null

# Find files larger than 100MB in /var, sorted by size
sudo find /var -size +100M -printf "%s\t%p\n" 2>/dev/null | \
  sort -rn | awk '{printf "%.1fM\t%s\n", $1/1048576, $2}' | head -20

# Find files not accessed in more than 90 days
find /var/log -atime +90 -type f -ls

# Find and delete log files older than 30 days (preview first with -ls)
find /var/log/archive -name "*.log" -mtime +30 -ls
find /var/log/archive -name "*.log" -mtime +30 -delete

# Find core dump files — often large and forgotten
find / -xdev -name "core" -o -name "core.[0-9]*" 2>/dev/null | xargs ls -lh

# Find files with no owner (orphaned — user deleted but file remains)
sudo find / -xdev -nouser -ls 2>/dev/null

# ── Debian / Ubuntu ──────────────────────────────────────────────

# Show how much space the apt cache is using
du -sh /var/cache/apt/archives/

# Remove cached packages that can no longer be downloaded (obsolete versions)
sudo apt autoclean

# Remove ALL cached package files (safe — they can be re-downloaded)
sudo apt clean

# Remove packages that were auto-installed as dependencies but are no longer needed
sudo apt autoremove --purge

# List installed kernels to identify old ones
dpkg --list | grep linux-image

# Remove a specific old kernel (keep current + 1 previous)
sudo apt purge linux-image-6.5.0-18-generic

# ── RHEL / Rocky ─────────────────────────────────────────────────

# Show dnf cache size
du -sh /var/cache/dnf/

# Clean all dnf cache
sudo dnf clean all

# Remove old kernels — keep only the 2 most recent
sudo dnf remove --oldinstallonly --setopt installonly_limit=2 kernel

# View logrotate configuration for a specific service
cat /etc/logrotate.d/nginx

# Force an immediate rotation (useful for testing or emergency cleanup)
sudo logrotate -f /etc/logrotate.d/nginx

# Run logrotate in debug mode — shows what would happen without making changes
sudo logrotate -d /etc/logrotate.conf

# ── systemd journal cleanup ───────────────────────────────────────

# Check current journal disk usage
journalctl --disk-usage

# Remove journal entries older than 2 weeks
sudo journalctl --vacuum-time=2weeks

# Limit journal to a maximum total size
sudo journalctl --vacuum-size=500M

# Set permanent journal size limit in journald config
sudo mkdir -p /etc/systemd/journald.conf.d/
sudo tee /etc/systemd/journald.conf.d/size-limit.conf <<'EOF'
[Journal]
SystemMaxUse=500M
SystemKeepFree=1G
MaxRetentionSec=2weeks
EOF
sudo systemctl restart systemd-journald

# ── Inode exhaustion diagnosis ────────────────────────────────────

# Check inode usage across all filesystems
df -i

# Find which directory contains the most files (the inode hog)
sudo find /var -xdev -printf '%h\n' 2>/dev/null | \
  sort | uniq -c | sort -rn | head -10

# Count files in a specific directory non-recursively
ls /var/spool/exim4/input | wc -l

# ── Deleted-but-open files ────────────────────────────────────────

# List all deleted files currently held open by running processes
sudo lsof +L1

# Filter to just the large ones (column 7 is file size in bytes)
sudo lsof +L1 | awk 'NR>1 && $7 > 104857600 {print $7/1048576"MB", $1, $2, $9}'

# The fix: restart the process that holds the deleted file open
# Example: nginx is holding a deleted access.log
sudo systemctl restart nginx