Debian 9 – root filesystem fills rapidly from logs and cache growth

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Disk exhaustion causes service failures, write errors, and package manager instability.

Environment & Reproduction

Common on long-running hosts with uncontrolled logs and apt cache growth.

# Capture baseline
df -h /
du -xh /var --max-depth=2 | sort -h | tail -n 30
apt-get clean -s

Root Cause Analysis

Unbounded log files, journal growth, caches, and orphaned artifacts consume root capacity.

Quick Triage

Find largest directories and identify active growth contributors.

# Quick triage
sudo du -x / --max-depth=2 2>/dev/null | sort -h | tail -n 40
find /var/log -type f -size +100M -print

Step-by-Step Diagnosis

Correlate top consumers with service behavior and retention policy gaps.

# Detailed diagnosis
ls -lh /var/log | sort -k5 -h
journalctl --disk-usage
dpkg -l | grep linux-image

Solution – Primary Fix

Purge caches, rotate/truncate oversized logs, and reclaim safe historical artifacts.

# Primary fix
sudo apt-get clean
sudo journalctl --vacuum-size=300M
sudo find /var/log -type f -name *.log -size +200M -exec truncate -s 0 {} ;

Solution – Alternative Approaches

Expand filesystem capacity or offload logs to external storage tiers.

# Alternatives
sudo logrotate -f /etc/logrotate.conf
sudo apt-get autoremove --purge

Verification & Acceptance Criteria

Sufficient free space remains and services recover without write failures.

# Verify
df -h /
journalctl --disk-usage
apt-get check

Rollback Plan

Restore archived logs if retention actions removed required forensic data.

# Rollback
ls -l /var/backups
cp /var/backups/ /var/log/ 2>/dev/null || true

Prevention & Hardening

Set quotas and retention controls with alerts before rootfs reaches critical thresholds.

# Hardening
cat /etc/logrotate.conf
crontab -l | cat

Related Errors & Cross-Refs

Related errors include no space left on device and read-only remount under pressure.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian storage housekeeping, logrotate, and capacity planning references.