Linux Disk Full Errors: Blocks, Inodes, Deleted Files, and Safe Cleanup
Diagnose ENOSPC when disk usage looks confusing, including exhausted inodes and deleted files still held open.
On this page
Check blocks and inodes separately
No space left on device can mean the filesystem has no free data blocks, or no free inodes for creating another file. Compare df -h with df -i; a workload that creates millions of tiny files can exhaust inodes while substantial byte capacity remains.
Find which directory consumes space before deleting anything. du -x can keep the scan on one filesystem, while find can help identify file counts and age. Check mount points with df -hT and findmnt; a full container overlay or temporary filesystem may not be the root disk.
Deleted files can still occupy space
Unlinking a file removes its directory entry, but disk blocks remain allocated while a process still has the file open. df can therefore report a full filesystem while du cannot account for the missing space. Inspect lsof +L1 where available to find open-but-deleted files and identify the owning process. Restarting or signaling the process to close the file releases blocks, but do so through the service's safe lifecycle rather than killing an unrelated process.
Find the actual source safely
Use a filesystem-bounded scan and inspect large directories and file counts. Logs, core dumps, temporary exports, container layers, and runaway spool directories are common causes. Confirm retention policy and application ownership before removing files. Deleting active database files or arbitrary files under /var/lib can turn a capacity issue into data loss.
For logs, configure rotation and ensure applications reopen rotated files. A process that keeps writing to a renamed or unlinked descriptor may continue consuming the old file. Monitor both filesystem byte usage and inode percentage, and alert before either reaches exhaustion.
Recovery and prevention
Free space from known disposable files or expand the correct volume; then identify why growth exceeded expectations. Add quotas or bounded retention for generated data, cap temporary-file creation, and ensure cleanup runs on failure. A cron job that deletes by broad wildcard may hide a leak or remove files still needed for recovery.