No space left on device on a Linux VPS: find and free disk space

# Size, usage and type of each filesystem
df -hT -x tmpfs -x devtmpfs

# IUse% column: 100% means no new file can be created
df -i -x tmpfs -x devtmpfs

# Inode count per directory, staying on /
sudo du --inodes -x -d 1 / | sort -n | tail -n 10

# The 15 largest top-level directories, staying on /
sudo du -xh -d 1 / 2>/dev/null | sort -h | tail -n 15

# Debian, Ubuntu
sudo apt install ncdu
# AlmaLinux, Rocky (EPEL repository)
sudo dnf install epel-release && sudo dnf install ncdu

sudo ncdu -x /

# Install lsof if needed: apt install lsof / dnf install lsof
sudo lsof -nP +L1

sudo systemctl restart nginx

sudo truncate -s 0 /proc/1234/fd/4

# Space used by the journal
journalctl --disk-usage

# Keep at most 500 MB of archives
sudo journalctl --vacuum-size=500M

# Or keep only the last two weeks
sudo journalctl --vacuum-time=2weeks

sudo mkdir -p /etc/systemd/journald.conf.d
sudo tee /etc/systemd/journald.conf.d/50-size.conf >/dev/null <<'EOF'
[Journal]
SystemMaxUse=500M
EOF
sudo systemctl restart systemd-journald

sudo du -xah /var/log 2>/dev/null | sort -h | tail -n 15

sudo truncate -s 0 /var/log/myapp/app.log

sudo tee /etc/logrotate.d/myapp >/dev/null <<'EOF'
/var/log/myapp/*.log {
    daily
    rotate 7
    # Rotate early if the file grows past 100 MB
    maxsize 100M
    compress
    delaycompress
    missingok
    notifempty
    # For an application that does not reopen its log file
    copytruncate
}
EOF

sudo logrotate -d /etc/logrotate.d/myapp

# Debian, Ubuntu: removes the .deb files in /var/cache/apt/archives
sudo apt clean

# AlmaLinux, Rocky: removes cached metadata and packages
sudo dnf clean all

# Lists what would be removed, without doing anything
sudo apt autoremove --purge -s

sudo apt autoremove --purge

# Installed kernels
rpm -q kernel

# Removes old versions beyond installonly_limit,
# never the running kernel
sudo dnf remove --oldinstallonly kernel

docker system df

# Stopped containers, unused networks, dangling images, build cache
docker system prune

# Also: every image no container uses
docker system prune -a

sudo sh -c 'du -h /var/lib/docker/containers/*/*-json.log' | sort -h | tail -n 5

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

sudo systemctl restart docker

-- List binlogs and their size
SHOW BINARY LOGS;

-- Remove those older than 7 days
PURGE BINARY LOGS BEFORE NOW() - INTERVAL 7 DAY;

SET GLOBAL binlog_expire_logs_seconds = 604800;

# Debian, Ubuntu: /etc/mysql/conf.d/ is read by MySQL and MariaDB
# AlmaLinux, Rocky: use /etc/my.cnf.d/binlog.cnf
sudo tee /etc/mysql/conf.d/binlog.cnf >/dev/null <<'EOF'
[mysqld]
# 7 days
binlog_expire_logs_seconds = 604800
EOF

# Partition holding /
findmnt -n -o SOURCE,FSTYPE /

# Reserved blocks (replace /dev/vda1 with the value above)
sudo tune2fs -l /dev/vda1 | grep -i 'reserved block count'

# Reserve at 1%, applies to a mounted filesystem
sudo tune2fs -m 1 /dev/vda1

# Once space is freed: back to 5%
sudo tune2fs -m 5 /dev/vda1

sudo tee /usr/local/bin/disk-alert >/dev/null <<'EOF'
#!/bin/sh
# Alert when a filesystem crosses the threshold (space or inodes)
THRESHOLD=85
DEST=admin@example.com

REPORT=$(
  for OPT in -P -iP; do
    df $OPT -x tmpfs -x devtmpfs -x overlay | awk -v t="$THRESHOLD" -v o="$OPT" '
      NR > 1 { sub("%", "", $5); if ($5 + 0 >= t) print $6, $5 "%", (o == "-iP" ? "inodes" : "space") }'
  done
)

[ -n "$REPORT" ] && printf '%s\n' "$REPORT" | mail -s "Disk almost full on $(hostname)" "$DEST"
exit 0
EOF
sudo chmod 755 /usr/local/bin/disk-alert

# Every 15 minutes
echo '*/15 * * * * root /usr/local/bin/disk-alert' | sudo tee /etc/cron.d/disk-alert >/dev/null

sudo sed 's/^THRESHOLD=85/THRESHOLD=1/' /usr/local/bin/disk-alert | sudo sh

sudo mkdir -p /mnt/rootfs
sudo mount --bind / /mnt/rootfs
sudo du -xh -d 2 /mnt/rootfs 2>/dev/null | sort -h | tail -n 15
sudo umount /mnt/rootfs