Diagnosing Disk Space Issues

Introduction

Running out of disk space is a common problem for system administrators and developers. When a disk fills up, applications can fail, and the system may become unstable. Knowing how to quickly diagnose and resolve these issues is a critical skill.

In this lab, you will step into the role of a system administrator who has received an alert about low disk space. You will learn a systematic approach to identify what is consuming the space and how to safely reclaim it. You will use a set of standard Linux command-line tools: df, du, find, and truncate. By the end of this lab, you will be confident in your ability to handle basic disk space emergencies.

Check Disk Usage

In this step, you will begin your investigation by getting a high-level overview of the disk space usage across all mounted filesystems. The best tool for this job is the df (disk free) command.

The df command reports the amount of disk space used and available on filesystems. Using it with the -h (human-readable) flag makes the output much easier to read by displaying sizes in powers of 1024 (e.g., Kilobytes, Megabytes, Gigabytes).

Execute the following command in your terminal to check the current disk usage:

df -h

You will see an output similar to this. Pay close attention to the Use% column, especially for the root filesystem, which is mounted on /. A high percentage here indicates a potential problem.

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda3        40G   38.5G  1.5G  96% /
tmpfs           1.8G     0  1.8G   0% /dev/shm
tmpfs          1.9G     0  1.9G   0% /sys/fs/cgroup
/dev/vdb1        20G  1.2G   19G   6% /home/labex/project
...

From the example output, you can see that the root filesystem (/dev/vda3, mounted on /) is at 96% capacity. This confirms that there is a disk space issue that needs to be addressed.

Find Large Files

In this step, after identifying that the disk is filling up, your next task is to find out which directories are consuming the most space. The du (disk usage) command is perfect for this. It estimates file space usage.

We will use du with the following options:

• -s: (summarize) to display only a total for each argument.
• -h: (human-readable) to print sizes in a more readable format (e.g., 1K, 234M, 2G).

Let's check the size of the contents within your project directory. Your current working directory is ~/project, so you can use a relative path.

Execute the following command to see the size of each file and subdirectory in the ~/project directory:

du -sh ~/project/*

The command will produce an output showing the size of each item. You should see the large file that was created during the lab setup.

3.0G /home/labex/project/large_data_archive.dat

This output tells you that a file named large_data_archive.dat inside your project directory is taking up 3.0GB of space. While this is one source of space consumption, the df output from the previous step suggested a larger problem, which might be located outside the home directory.

Locate Large Log Files

In this step, you will investigate another common cause of disk space issues: large log files. System and application logs are often stored in the /var/log directory. If not properly managed, these files can grow indefinitely.

The find command is a powerful utility for searching for files and directories. You can use it to locate files based on various criteria, such as name, type, and size.

We will use find to search for any files (-type f) in the /var/log directory that are larger than 10 Megabytes (-size +10M). Since the /var/log directory is owned by the root user, you'll need to use sudo to grant administrative privileges for the command to inspect all files.

Run the following command in your terminal:

sudo find /var/log -type f -size +10M

The command will scan the specified directory and print the path of any file that matches the criteria. Your output might show more than one file.

/var/log/syslog
/var/log/journal/deaaf690a67544aaaa83c02167a202c6/user-6000@0005fc8f16f7df1a-7ea5bde2c8c33f92.journal~

The output clearly shows that /var/log/syslog is larger than 10MB. While other large files like journal logs might also be present, we will focus on syslog for this exercise. You have now identified a specific, large log file that is contributing to the disk space problem.

Clean a Log File

In this step, now that you've identified a large log file, you need to free up the space it's consuming. Simply deleting the file with rm can sometimes cause problems if a service is actively writing to it. A safer method is to empty the file's contents without deleting the file itself.

The truncate command is designed for this purpose. It can shrink or extend the size of a file to a specified size. By setting the size to zero, you effectively empty the file.

You will use truncate with the -s 0 option, which sets the file size to 0 bytes. Again, you'll need sudo because you are modifying a system file.

Execute the command below to clear the contents of syslog:

sudo truncate -s 0 /var/log/syslog

A successful truncate command produces no output. To verify that it worked, you can use the ls -lh command to check the file's new size.

ls -lh /var/log/syslog

The output should now show the file size as 0.

-rw-r----- 1 syslog adm 0 Oct 22 15:31 /var/log/syslog

You have successfully and safely cleared the large log file, freeing up disk space.

Verify the Fix

In this step, you will perform the final and most important action: verifying that your efforts have resolved the disk space issue. You will use the df -h command again, just as you did in the first step.

By comparing the new output with the original one, you can confirm that disk space has been freed.

Run the df -h command one more time:

df -h

You should see an output where the Use% for the root filesystem (/) is lower than it was in Step 1.

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda3        40G   37G  3.0G  92% /
tmpfs           1.8G     0  1.8G   0% /dev/shm
tmpfs          1.9G     0  1.9G   0% /sys/fs/cgroup
/dev/vdb1        20G  1.2G   19G   6% /home/labex/project
...

The usage has dropped from 96% to 92%, confirming that truncating the log file worked. To complete the cleanup, you can also remove the large data file you found in your project directory.

rm ~/project/large_data_archive.dat

Now, run df -h one last time to see the final result of all your cleanup actions. The available space should have increased even more. This confirms that you have successfully diagnosed and resolved the disk space issue.

Summary

Congratulations on completing the lab! You have successfully diagnosed and resolved a common disk space issue on a Linux system.

In this lab, you learned a practical, step-by-step workflow:

1. You used df -h to get a high-level overview of disk usage and confirm a problem.
2. You used du -sh to inspect the size of specific directories and identify large files.
3. You used find to search for files based on specific criteria, such as size, to pinpoint large log files.
4. You learned to use truncate -s 0 as a safe way to empty a file without deleting it.
5. Finally, you verified your fix by re-running df -h to see the reclaimed space.

These commands are essential tools for any Linux user or system administrator. With this knowledge, you are now better prepared to keep your systems running smoothly.