Clean logs and cache

A full disk causes cascading errors: the database refuses to write, Nginx cannot create temporary files, systemd can no longer log. Before deleting anything, measure, then address the causes in order: logs, packages, caches, containers. Deleting at random often frees less than expected, or breaks a service.

Measure before acting

df -h
df -i
sudo du -xh --max-depth=1 / 2>/dev/null | sort -h
sudo journalctl --disk-usage

Also look at /var, where most culprits live: systemd journals, Nginx logs, APT cache, Docker images, mail queues. If df -i shows 100% while df -h shows free space, the problem is inodes, often millions of small files in a cache or session store.

systemd journals

Use the command that understands the journal format:

sudo journalctl --vacuum-time=14d
sudo journalctl --vacuum-size=500M

--vacuum-time removes entries older than the given duration, --vacuum-size shrinks the whole set below the given size. For a permanent limit, edit /etc/systemd/journald.conf:

SystemMaxUse=500M

Then restart the service: sudo systemctl restart systemd-journald. Do not delete files in /var/log/journal by hand: journald keeps them open and the space is not actually returned.

Packages and caches

APT.

sudo apt clean
sudo apt autoremove --purge
sudo du -sh /var/cache/apt/archives

apt clean empties the downloaded .deb cache. apt autoremove --purge removes packages that became unnecessary, but read the list before confirming: an automatically marked package may be required by a service you installed manually.

Application caches and temporary files.

sudo systemd-tmpfiles --clean
npm cache clean --force
pip cache purge
composer clear-cache

systemd-tmpfiles --clean applies retention rules to /tmp and /var/tmp. Do not delete recent /tmp files: sockets, sessions and lock files of running services live there. For application caches, use the tool's own command rather than rm -rf on a directory whose role you do not know.

Docker

docker system df
docker image prune -a
docker builder prune

docker system df breaks usage down into images, containers, volumes and build cache. docker image prune -a removes unused images, docker builder prune the build cache. Do not add --volumes without listing volumes first: it deletes persistent data. Stop containers that write before an aggressive cleanup.

Safety rules

• Always list a path's contents before deleting it.
• Prefer tools that understand the format: journalctl, apt, docker.
• Check df -h before and after to measure the real gain.
• Fix retention instead of cleaning every month: a disk that fills in a week is a symptom, not a housekeeping problem.