Your disk still looks full because a program is still using a log file you’ve already deleted. Linux keeps the file’s space occupied until the program stops using it.
That’s why the df command still shows a full disk, even though you’ve deleted the file. Meanwhile, your application can’t save new data and keeps showing the No space left on device error.
This guide explains why those deleted files still take up space, why the df and du commands show different results, and how to find the program responsible using lsof. You’ll also learn how to free up disk space safely, starting with two simple checks. Let’s get into it.
Why Is Your Linux Disk Full After You’ve Deleted the Files?
Removing a file only unlinks its name from the directory, but Linux keeps its data on the hard drive until the program closes it.
Two mechanics explain the whole situation, and both take about a minute to check.
How open file handles keep space in use
Every open file on a Linux system gets a file descriptor, which is the number a process uses to read and write it. Even after you delete the file, its data remains until the last program using it closes it. The Linux unlink documentation confirms this behaviour.
For example, a web server might keep writing to a deleted log file. The file no longer appears in its folder, but its size continues to grow and use disk space.
You’ll have seen this if you’ve ever cleared logs during an incident without restarting the service. However, you may need to close the file or restart the affected service safely before Linux releases the space.
Why the df Command and du Command Disagree
The df -h command shows how much space your filesystem uses and how much remains free. On the other hand, the du command measures the space used by files it finds in directories.
That difference becomes important when a program holds a deleted file open. The file still uses disk space, so df counts it. But du can’t find the deleted file in its original folder. And a large gap between the results is a reason to investigate, rather than proof that deleted files caused the problem.
Other filesystem activity also affects the numbers. If the disk still refuses new files, run df -i to check inode usage (inodes are records Linux uses to track files and folders). A disk with too many small files can run out of these records even when storage space remains.
After the initial investigation, use df -hT to check the filesystem type. For instance, an ext4 filesystem stores data on a disk, while tmpfs uses temporary memory-backed storage. This helps you identify which filesystem is full before deciding what to clean.
Using lsof to Find Deleted Open Files Eating Linux Disk Space
The lsof command helps you find deleted files that running programs still use. Its name stands for list open files. Run sudo lsof L1 to see files that have been deleted but remain open.
Once the results appear, focus on four columns:
- COMMAND: Find the name of the program that’s still using the deleted file.
- PID: Each running program has a process ID, which helps you identify the one responsible.
- SIZE/OFF: Check this value for the file’s size or current position, depending on the output.
- NAME: The original file path usually appears here, followed by
(deleted).
After identifying the program, decide how to release the space. Restarting the affected service is often the safer option because it closes the deleted file. But first, check if restarting will interrupt users or ongoing tasks.
If restarting isn’t practical, there’s another option, though it needs extra care. You can empty an open file through its file descriptor, which is how Linux tracks files a program is using.
For example, : > /proc/1842/fd/4 attempts to empty the file opened as descriptor 4 by process 1842. Only use this after confirming the correct process and file. Emptying the wrong file can destroy data, and some programs may behave unexpectedly.
Once you’ve recovered the space, check why the log grew so large. If the program keeps writing without proper log rotation, the disk will fill again.
Tip: On a shared Linux server, run lsof with sudo. That way, you can inspect files opened by other users’ processes.
Check Linux Disk Usage: How to Find Large Directories and Files
With the culprit ruled out, checking disk usage in Linux with du takes minutes and points you straight at the largest directories eating your space. Start with the largest directory and work your way into its subfolders. This helps you find the problem without checking every folder individually.
Three commands cover almost every case on a standard install:
- Top-Level Sweep: Start with
sudo du -h --max-depth=1 / | sort -hto compare the sizes of your main directories. Check the largest result first. On servers,/varis a common place to investigate because it stores logs and other changing data. - One Level Down: If /var takes up the most space, run sudo du -sh /var/ to see which subfolders are responsible. Then repeat the check inside the largest one. Each pass brings you closer to the files using the space.
- Find the Largest Files Directly: Once you’ve narrowed down the directory, use sudo find /var -xdev -type f -size 100M to locate files larger than 100 MB. Check the results for old backups, database dumps, or oversized logs. The command finds large files but doesn’t sort them by size.
If you’d rather see it visually, install ncdu and move through folders with the arrow keys. Either way, you’ll know your disk space usage before you delete a single thing.
Safe Commands to Clean Up When the Disk Is Full
Once you know what’s filling the disk, choose a cleanup method that suits the files you’ve found. Some commands remove old files immediately, while others require a service restart. Run df -h after each step to check how much space you’ve recovered.
Fair Warning: Before deleting anything else, check if the disk has reserved space. On ext4 file systems, Linux typically reserves 5% of storage for the root user by default. This helps administrators recover a nearly full disk when regular users can’t save new files.
The following commands address common causes of a full disk, but check their effects before running them.
| Target | Command | Notes |
|---|---|---|
| Package cache | sudo apt clean |
Safe on any Debian or Ubuntu box |
| Systemd journal | sudo journalctl --vacuum-size=200M |
Keeps recent system logs, drops the old ones |
| Docker leftovers | sudo docker system prune -a |
Clears unused images and stopped containers |
| Deleted open file | Restart the service | Frees up disk space; df still counts |
After each cleanup, run df -h again to see if the available space has increased. If the disk remains full, return to the largest directories and check what’s still using the space.
Keep Your Disk Space Under Control
A full disk on Linux is rarely about the files you can see. Once you know that processes hold deleted files open, the fix takes minutes rather than a whole afternoon.
Next time your disk fills up, compare df and du to check where the space is going. If their results differ, use lsof to look for deleted files that remain open. Once you’ve fixed the problem, check your log rotation settings to prevent the same issue.
For more help with Linux disk problems, visit Basic Linux for plain-language guides on disk space, filesystems, and server maintenance commands.