Finding what fills the disk

When a server reports a full disk, guessing directories wastes time. Start with the top level and let sort do the work:

du -xh --max-depth=1 / 2>/dev/null | sort -h | tail

The -x flag keeps du on one filesystem, so mounted volumes and /proc do not distort the result. Repeat the command inside the biggest directory until the culprit is obvious. If ncdu is installed, ncdu -x / does the same interactively.

Sometimes df says the disk is full but du finds far less. That usually means a deleted file is still held open by a running process. List those with:

lsof +L1

The fix is to restart or reload the process that holds the file, which finally releases the space.