VPS Disk Full? Find Large Files & Clean Logs Safely

1. Why Does VPS Disk Fill Up Silently?

A VPS that has been running for a while often hits disk full without warning. Several sources accumulate disk space quietly: web server access logs grow daily, package managers cache downloaded files, database binary logs pile up, or unused Docker images sit dormant consuming gigabytes.

The consequences of a full disk are usually more severe than expected:

2. Check Disk Usage First

Always start with an overview of disk usage across the entire system:

# Check all filesystems in human-readable format
df -h

# Check only main disk (exclude tmpfs)
df -h --type=ext4 --type=xfs

# Check inode usage (small files can exhaust inodes before disk space)
df -i

Example output to analyze:

Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        50G   47G  3.0G  94% /
tmpfs           1.9G  1.2M  1.9G   1% /dev/shm

3. Find Large Files and Directories

Once you know the disk is full, the next step is identifying what is consuming the most space:

Method 1: du + sort (No Installation Required)

# Find 20 largest directories from root
du -ah / --max-depth=3 2>/dev/null | sort -rh | head -20

# Check /var specifically (most common culprit)
du -sh /var/* 2>/dev/null | sort -rh | head -10

# Find files larger than 100MB
find / -type f -size +100M -not -path "/proc/*" 2>/dev/null | xargs du -sh | sort -rh

Method 2: ncdu (Recommended — Interactive Interface)

# Install ncdu
apt install ncdu -y       # Ubuntu/Debian
yum install ncdu -y       # CentOS/RHEL

# Scan and browse interactively
ncdu /

# Or scan only /var
ncdu /var

4. Clean Log Files Safely

Log files are the most common cause of disk full on a running VPS. Here is how to clean them safely:

Nginx / Apache Logs

# Check log sizes
ls -lh /var/log/nginx/
ls -lh /var/log/apache2/

# Truncate log content (SAFE — keeps file open for process)
> /var/log/nginx/access.log
> /var/log/nginx/error.log
> /var/log/apache2/access.log
> /var/log/apache2/error.log

# Reload service to re-open file descriptor
nginx -s reopen
# or
systemctl reload nginx

System Logs (/var/log)

# Find large log files in /var/log
find /var/log -name "*.log" -size +50M | xargs ls -lh

# Remove journal logs older than 7 days
journalctl --vacuum-time=7d

# Or limit journal size to 200MB
journalctl --vacuum-size=200M

# Delete compressed old logs (already rotated)
find /var/log -name "*.gz" -mtime +30 -delete
find /var/log -name "*.1" -mtime +7 -delete

MySQL/MariaDB Binary Logs

# List binary logs
ls -lh /var/lib/mysql/mysql-bin.*

# Purge binary logs older than 7 days (run in MySQL)
mysql -u root -p -e "PURGE BINARY LOGS BEFORE DATE_SUB(NOW(), INTERVAL 7 DAY);"

# Disable binary logs if replication is not used (edit /etc/mysql/mysql.conf.d/mysqld.cnf)
# skip-log-bin

5. Clean apt/yum Package Cache

Package managers accumulate .deb or .rpm files after every installation. These are safe to remove completely:

Ubuntu / Debian (apt)

# Clean all cached packages
apt clean

# Remove unused dependency packages
apt autoremove -y

# Check cache size before cleaning
du -sh /var/cache/apt/archives/

# Aggressive clean including package lists
apt clean && apt autoclean

CentOS / RHEL / Rocky Linux (yum/dnf)

# Clean yum cache
yum clean all

# Clean dnf cache (CentOS 8+/Rocky)
dnf clean all

# Remove unused packages
dnf autoremove

6. Clean Temp Files and Old Kernels

Temporary Files

# Check /tmp size
du -sh /tmp/

# Delete files in /tmp older than 7 days
find /tmp -type f -mtime +7 -delete
find /tmp -type d -empty -delete

# Clean /var/tmp older than 30 days
find /var/tmp -type f -mtime +30 -delete

Old Linux Kernels

# List installed kernels
dpkg --list | grep linux-image

# Show currently running kernel (do NOT remove this one)
uname -r

# Auto-remove old kernels (Ubuntu handles this automatically)
apt autoremove --purge -y

# Manually remove a specific old kernel
dpkg --purge linux-image-OLD-VERSION-generic

7. Clean Docker Images and Volumes

If your VPS runs Docker, it can be one of the biggest disk consumers — especially old images from builds and stopped containers:

# Check Docker disk usage
docker system df

# Remove stopped containers + unused images + networks + build cache
docker system prune -f

# Remove everything including volumes (WARNING: data will be lost)
docker system prune -af --volumes

# Remove only dangling images (untagged)
docker image prune -f

# List and remove unused volumes
docker volume ls -qf dangling=true | xargs -r docker volume rm

8. Configure logrotate to Prevent Recurrence

A one-time cleanup is not enough. Configure logrotate to automatically rotate logs before they grow too large:

# View existing nginx logrotate config
cat /etc/logrotate.d/nginx

# Create or update nginx logrotate config
cat > /etc/logrotate.d/nginx << 'EOF'
/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        nginx -s reopen
    endscript
}
EOF

# Test the configuration
logrotate -d /etc/logrotate.d/nginx

# Force run logrotate now
logrotate -f /etc/logrotate.conf

Cron Jobs for Automated Cleanup

# Open crontab
crontab -e

# Clean apt cache every Sunday at midnight
0 0 * * 0 apt clean && apt autoremove -y >> /var/log/apt-cleanup.log 2>&1

# Vacuum journal logs every day at 2 AM
0 2 * * * journalctl --vacuum-time=7d >> /var/log/journal-cleanup.log 2>&1

9. Monitor Disk Before It Fills Up

The best approach is knowing about disk issues before they become critical. Set up proactive alerts:

Simple Disk Alert Script via Email

#!/bin/bash
# /usr/local/bin/disk-alert.sh
THRESHOLD=80
DISK_USAGE=$(df / | awk 'NR==2 {print $5}' | tr -d '%')

if [ "$DISK_USAGE" -gt "$THRESHOLD" ]; then
  echo "WARNING: Disk usage is ${DISK_USAGE}% on $(hostname)" | \
  mail -s "Disk Alert: ${DISK_USAGE}% used" [email protected]
fi

# Schedule check every 6 hours
0 */6 * * * /usr/local/bin/disk-alert.sh

Using Netdata (Recommended)

# Install Netdata
bash <(curl -Ss https://my-netdata.io/kickstart.sh)

# Access dashboard at http://YOUR_IP:19999
# Configure alerts in /etc/netdata/health.d/

apt clean && apt autoremove -y
journalctl --vacuum-time=3d
> /var/log/nginx/access.log
find /tmp -mtime +1 -delete
df -h  # verify result