What files can be deleted when there is not enough disk space in Linux

There are situations when the disk space has run out completely and you need to urgently clean the disk and delete files. Disk space may run out even so that

• when trying to clear the installation package cache, the system will report an error (there is no place even to save the lock file),
• when trying to install ncdu to search for overgrown folders and files, the system will not be able to find even the 81 kilobytes required for this command
• when trying to find the files and folders that take up the most space in Linux, the system will also give an error due to the fact that the sort command will not be able to save the data cache to disk if there is a lot of this data

That is, there are really critical situations – in these conditions, many programs and services stop working normally. Therefore, the task becomes the following: urgently at any cost to free up disk space so that you can continue servicing the system and proceed to the second stage – searching for directories and files that led to this problem due to the fact that they began to take up too much space.

I will warn you in advance: the following commands, although they mainly delete useless files, after their execution can lead to the following consequences:

• the services will need to be restarted for them to work properly (so that they re-create the log files, caches, lock files)
• various logs and files from the recycle bin may be lost, which, although not needed by most users, in some conditions you may want to keep them (for example, it is important for you to examine the log files, as they may be the cause of the problem).

This means that DO NOT mindlessly copy commands – read the explanations for them and evaluate how painless they are for your situation.

1. Deleting temporary files

The files in the /tmp/ directory will be deleted anyway on the next system reboot. That is, on the one hand, they can be removed quite painlessly:

sudo rm -rf /tmp/*

BUT: programs that are currently running and that have saved some data to the /tmp/ directory may be broken.

2. Deleting cache files

The /var/cache/ directory has many subdirectories that can be deleted almost painlessly (data will not be lost, and programs will create new cache files). This directory is of particular interest because on some systems caches grow to gigabytes and tens of gigabytes. Sometimes looking for a problematic directory in /var/cache/ can finally solve a situation with a lack of disk space.

To remove the font cache:

sudo rm -rf /var/cache/fontconfig/

To remove the installation package cache (on Debian, Linux Mint, Ubuntu, Kali Linux and derivatives):

sudo rm -rf /var/cache/apt/

To remove the installation package cache (on Arch Linux, BlackArch and their derivatives):

sudo rm -rf /var/cache/pacman/

Deleting the man page cache:

sudo rm -rf /var/cache/man/

You can continue searching for large caches applicable to the software installed on your system. For example, these can be web server caches, proxy servers, etc.

3. Delete logs

In this directory (/var/log/) you can delete almost all files, but try to keep the folder structure, because some applications, after deleting a directory here, are not able to create it a second time…

On web servers, the web server logs can grow too large.

To remove Apache logs on Debian, Linux Mint, Ubuntu, Kali Linux and derivatives:

sudo rm -rf /var/log/apache2/*

To remove Apache logs on Arch Linux, BlackArch and their derivatives:

sudo rm -rf /var/log/httpd/*

In order for the server to start creating and writing to new log files, the Web Server service must be restarted.

Depending on the intensity of system usage, the accumulated logs can take up gigabytes. Depending on the system, the files may have different names, a more accurate analysis is recommended to be performed using the ncdu utility:

sudo ncdu /var/log/

4. Empty the trash

This tip is more for desktop systems. The files you deleted in the desktop GUI end up in the ~/.local/share/Trash/files/ folder, you can analyze them and delete them (second time) if you wish:

ncdu ~/.local/share/Trash/files/

5. Remove unnecessary kernel header source code files

The following is only relevant for Debian, Linux Mint, Ubuntu, Kali Linux and their derivatives. Check the /usr/src/ folder, there will be subfolders like linux-headers-; most of them can be deleted – leave only the one whose number corresponds to the current kernel of the system – this is usually the most recent release number.

6. Remove orphaned packages

Orphaned packages are those packages (programs) that were installed as dependencies for other programs. But for various reasons, they are no longer needed: either the program that used them was removed, or for that program they ceased to be dependencies after updating the program.

On Debian, Linux Mint, Ubuntu, Kali Linux and their derivatives, you can remove unnecessary packages as follows:

sudo apt autoremove

For Debian and derivatives, the previous command is completely safe.

On Arch Linux and derivatives, the list of orphaned packages can be seen as follows:

pacman -Qdt

Before proceeding with their automatic removal, it is highly recommended to study this list!

To recursively remove orphans and their config files on Arch Linux and derivatives:

sudo pacman -Rns $(pacman -Qtdq)

If no orphaned packages were found, pacman will exit with an “error: no targets specified (use -h for help)”. This is expected since pacman -Rns took no arguments.

7. Clean up systemd logs

Over time, in some systems, the system logs begin to take up gigabytes on the hard drive. You can view the logs and free up space using the journalctl command.

To see how much space the logs are taking up, run:

journalctl --disk-usage

To remove all entries, leaving only entries per 100 megabytes, run:

journalctl --vacuum-size=100M

Or to delete all system log entries older than one week:

journalctl --vacuum-time=1weeks

8. Files in the /lost+found directory

The /lost+found directory contains files that were found after checking the disk file system. Typically, such checks are performed after a sudden reboot of the system or if there are signs of disk problems.

The files found are usually corrupted. Their goal is to save data that, if errors were corrected on the file system, would be completely lost.

The /lost+found folder may be empty (if there were no problems with the disk). If there are files there, then you can view them and, if desired, delete them.

9. Clean up PHP sessions

Sometimes web applications can create countless sessions due to a bug. Check the /var/lib/php/sessions/ directory for too many files.

(BONUS) 10. Analyze Docker Files

Don't mindlessly delete Docker files. I'm giving this directory as an example only because it caught my attention because of its sheer phantasmagoric size – and this despite the fact that I don't actually use Docker – I literally tried it several times to see what it is.

The largest folder is /var/lib/docker/overlay2/. To analyze disk space occupied, run:

sudo ncdu /var/lib/docker/

Conclusion

So, we have considered which files can be deleted from Linux with little or no loss of information. In addition to the directories discussed, which can be cleared both on a remote system with a web server and on a home computer, users with a graphical desktop should pay attention to such directories as:

• ~/.cache
• ~/.local
• ~/Downloads (your downloaded files)

They do NOT need to be removed, but worth analyzing. For example, you may find out that the web browser on your computer has a cache of several gigabytes and that you can free them (it is recommended to do it using the web browser, rather than deleting files directly).

If I missed any directories with files that can be safely deleted, then write them in the comments!