Troubleshooting

No space left on device, even when df shows free space

ENOSPC has three causes: a genuinely full disk, exhausted inodes, or a deleted file still held open. How to diagnose and reclaim space for each.

Published · Updated ~6 min read
On this page

No space left on device (ENOSPC) stops writes cold: logs, databases and package installs all fail, and a website often shows a 500 Internal Server Error before anyone sees the message. Usually the disk is genuinely full, but two sneakier causes give the same message with gigabytes apparently free: exhausted inodes, or a large file still held open after deletion. Check all three.

1. Is the disk actually full?

check usage
df -h        # look for a mount at 100% Use%
df -i        # inode usage — 100% here also causes ENOSPC

If df -h shows 100%, find the biggest offenders:

find what is eating space
sudo du -xh / 2>/dev/null | sort -rh | head -20
# faster interactive tool if installed:
sudo ncdu /

2. The usual space hogs

reclaim common space
# apt cache
sudo apt clean

# old journald logs — cap them at 200M
sudo journalctl --vacuum-size=200M

# rotated logs
sudo find /var/log -type f -name "*.gz" -delete

# unused Docker layers (can be huge)
docker system prune -af

3. Free space but still ENOSPC: inodes

Millions of tiny files (session caches, mail queues) exhaust inodes while bytes remain. If df -i shows 100%, find the directory with the most files and clear it:

find inode hogs
for d in /var/*; do echo "$(sudo find "$d" 2>/dev/null | wc -l) $d"; done | sort -rn | head

4. Free space but still full: a deleted-but-open file

A service writing to a log you already rm’d keeps the space allocated until it closes the file. df and du disagree in this case. Find it:

deleted files still held open
sudo lsof +L1 | sort -k7 -rn | head
# restart the service that owns it, or truncate live:
sudo truncate -s 0 /proc/<PID>/fd/<FD>

A full /boot is the one case that can outlive the cleanup: a kernel update that ran out of room there leaves a half-written initramfs behind, and the next boot fails. If the server has started restarting or stopping during boot since the disk filled, see VPS keeps rebooting.

Longer term: more disk

If cleanup only buys a few days, the volume is undersized for the workload. VMHeaven plans run on replicated NVMe storage and can be resized: see the Standard KVM line for capacity that keeps ahead of your logs and data. When only the disk is short, not CPU or RAM, storage blocks add 15 GB each for €1.00 a month from the panel while the server keeps running; then extend the partition and filesystem to use them.

Frequently asked

df says there is free space but I still get ENOSPC. Why?

Two common reasons: inodes are exhausted (check 'df -i'), or a process still holds a deleted file open, keeping its space allocated. Restart that process or truncate the fd.

What is safe to delete first?

Caches and logs: 'apt clean', 'journalctl --vacuum-size=200M', old *.gz logs, and 'docker system prune -af'. Avoid touching /var/lib (databases) and /boot.

How do I find what is filling the disk?

Run 'sudo du -xh / | sort -rh | head -20', or use ncdu for an interactive view.

Related articles

All troubleshooting

How to add swap space on Ubuntu and Debian: swap file, size and swappiness

Create a swap file with fallocate, enable it, keep it after reboots and tune swappiness. How much swap a small VPS needs, and when swap will not save you.

What is block storage? Block vs file vs object storage, and using a volume on Linux

Block storage presents raw disk blocks your server formats itself: how it differs from file and object storage, and how to format, mount and grow a volume.

500 Internal Server Error on your server: read the log, then fix the cause

A 500 means your app or web server hit an error it could not handle. Read the log, then fix PHP fatals, memory_limit, .htaccess, permissions or a full disk.

Read-only file system: why Linux stops writing, and how to repair or remount safely

Read-only file system (EROFS) means the kernel blocks writes: a deliberate ro mount, or ext4 errors. Check findmnt and dmesg, then fsck offline before remount.

lsof command: find what uses a port, a file or deleted disk space

The lsof command lists open files and their processes: lsof -i :PORT, -p PID, -u user, +D dir, deleted files with lsof +L1, and lsof with kill.

find command in Linux: search by name, size, age and permissions, with -exec and -delete

The find command in Linux by example: -name, -type, -size, -mtime, -perm, -maxdepth, -exec vs -exec +, safe -delete, -print0 with xargs and -prune.

How to stop and remove Docker containers, images and volumes

Docker remove container and image commands: docker stop, rm -f, rmi, prune with -a and --volumes, the image is being used error and docker system df.

LVM in Linux: extend a logical volume, add a disk, snapshots and shrink rules

LVM in Linux: check if your server uses it, grow the root volume after a disk resize with growpart, pvresize and lvextend -r, snapshots, shrink rules.