What you will achieve

Locate what is eating disk space using du and the interactive ncdu TUI — faster than guessing which log directory exploded.

1) Quick summary

df -hT
sudo du -xh --max-depth=1 / | sort -h

2) Drill into suspects

sudo du -xh --max-depth=1 /var | sort -h
sudo du -xh --max-depth=2 /var/lib/docker | sort -h

3) ncdu (interactive)

sudo apt install ncdu
sudo ncdu /

Navigate with arrows, delete with d (careful). Scan /var/log, /var/cache/apt, and journald (/var/log/journal).

4) Journal vacuum

journalctl --disk-usage
sudo journalctl --vacuum-size=500M

Verify

df -h /

Confirm free space increased and services still run after any cleanup.

5) Find large files quickly

sudo find / -xdev -type f -size +500M -exec ls -lh {} \; 2>/dev/null

6) Docker cleanup

docker system df
docker system prune -a --volumes

Prune removes unused images — confirm nothing important is only tagged locally.

7) APT cache

sudo du -sh /var/cache/apt/archives
sudo apt clean

Logrotate not running

If /var/log dominates, check logrotate.status and cron/timer — see logrotate guide. Application logging to stdout without rotation fills disks on container hosts too.

8) inode exhaustion

df -i

Disk can show free space while inodes are 100% — millions of tiny files in node_modules or mail queues. ncdu shows file counts per directory.

Prerequisites

Sudo for scanning root-owned dirs. ncdu installed. Awareness that deleting random large files in /var/lib can destroy databases — identify before pressing delete in ncdu.

Scheduled reports

sudo ncdu -o /var/log/ncdu-$(date +%F).json /

Export JSON for trending disk growth without interactive TUI — parse in monitoring later.

/var/lib/docker overlay2

sudo du -sh /var/lib/docker/overlay2/* | sort -h | tail

Each layer accumulates — prune unused images before blaming mystery disk use on logs.

Quota enforcement

After finding heavy users with du -sh /home/*, enable filesystem quotas: quotacheck -cum /home, edquota username. Prevents one user refilling disk after cleanup. For btrfs, btrfs qgroup limit on subvolumes caps docker and home independently — ncdu shows growth but quotas stop recurrence.

Compare snapshots over time

Weekly ncdu JSON export diffed in script highlights fastest growing paths — proactive alert before 100% full page ops at 3am. Include /var/lib/containerd for Kubernetes worker nodes not just classic docker paths.

Package cache on CI runners

Self-hosted GitHub Actions runners accumulate docker layers and apt cache — schedule weekly ncdu review on runner fleet separate from production server monitoring.