Why Is a Linux Server Still Out of Disk Space After Log Deletion?

A Linux server can report a full filesystem even after someone deletes old logs. One common reason is that a running process still has the deleted file open: the directory entry is gone, but the storage is not released until the process closes it. Other causes include a different full mount, large container layers, temporary files, or filesystem reserves.

Find which filesystem is full

Start with df -hT to identify the affected mount and filesystem type. Then use df -ih to check inode exhaustion; a system can fail to create files even when byte capacity remains if it has run out of inodes. Use du -xhd1 /path on the affected mount to find large directories without crossing into other filesystems.

Look for deleted files still held open

With appropriate permissions, lsof +L1 can show open files whose link count is zero. Confirm the owning process and service before taking action. Restarting or signaling a process may release the space, but it can interrupt work or affect customer traffic. Coordinate a maintenance window if the process is production-critical.

Prevent the same incident

• Configure log rotation to signal the application to reopen logs, using the application's documented method.
• Set retention limits and monitor both filesystem bytes and inode use.
• Review container, package cache, temporary, and backup retention policies.
• Alert on sustained growth before the filesystem reaches its operational threshold.

When server administration support helps

Repeated disk incidents may point to missing rotation, a runaway process, an undersized volume, or unclear ownership of application data. Informatix Systems lists Linux server administration as a service area. An assessment can review capacity trends, service impact, rotation behavior, and monitoring for the affected host.

Share the mount, filesystem output, recent changes, and affected services when requesting help. Contact Informatix Systems to discuss Linux server support.