The Linux Server Disk Cleanup Playbook: Reclaim Root Partition Space

Bottom Line: Linux servers running Ubuntu, Debian, RHEL, or CentOS frequently suffer from root partition (/) disk space exhaustion caused by unvacuumed systemd journals (journalctl), orphaned APT package caches (/var/cache/apt), stale Docker container layers, and system crash core dumps (/var/lib/systemd/coredump). Running this 5-minute sysadmin playbook reclaims 10 GB to 100 GB+ of server disk space safely.

Understanding Linux Root Partition (/) Storage Exhaustion

When a production Linux server runs out of disk space on the root partition (/) or /var, critical system processes freeze or crash immediately:

1. Database Crash Loops: MySQL, MariaDB, and PostgreSQL shut down to prevent transaction log corruption (No space left on device).
2. SSH Connection Failures: OpenSSH fails to allocate PTY terminals or write session environment variables.
3. Web Server Outages: Nginx and Apache drop incoming HTTP requests due to full error log buffers.
4. Cron Job Failures: Scheduled background cron jobs fail silently when temporary script outputs cannot be written.

+-------------------------------------------------------------------------+
| [System Files: 15GB] [/var/log & journal: 45GB] [Free: 0GB (CRITICAL)]   |
+-------------------------------------------------------------------------+
                                        ^
                              Root Partition Exhaustion!

The 8 Primary Causes of Linux Server Storage Bloat

1. Systemd Journal Logs (/var/log/journal) — 10 GB to 50 GB

systemd-journald captures stdout, stderr, and system events from every active service daemon. Without a explicit retention limit, log files expand continuously.

2. APT Package Archives (/var/cache/apt/archives) — 5 GB to 25 GB

Debian and Ubuntu retain every .deb package archive file downloaded during apt-get update and apt-get upgrade.

3. Docker Image Layers & Container Storage (/var/lib/docker) — 15 GB to 100 GB

Dangling container image layers, stopped containers, buildkit caches, and anonymous volumes accumulate indefinitely unless pruned.

4. Systemd Core Dumps (/var/lib/systemd/coredump) — 5 GB to 30 GB

When C/C++ or Node.js native addon binaries crash, systemd writes full process RAM memory dumps (.zst or .lz4) to disk.

5. Old Linux Kernel Images (/boot) — 3 GB to 15 GB

Kernel updates install new kernel images (vmlinuz, initrd.img) while preserving historical kernels in /boot.

6. Stale Snap & Flatpak Revisions (/var/lib/snapd/snaps) — 5 GB to 20 GB

Snap retains multiple historical revisions of installed Snap packages (such as lxd or canonical-livepatch).

7. Temporary Files (/var/tmp & /tmp) — 5 GB to 20 GB

Unlike /tmp which is mounted in RAM (tmpfs) or cleared on reboot, /var/tmp preserves temporary files indefinitely across reboots.

8. Nginx & Apache Access/Error Logs (/var/log/nginx) — 5 GB to 30 GB

High-traffic web servers generate gigabytes of plain text access logs if logrotate compression fails.

Sysadmin Command Playbook to Clean Linux Server Storage

Follow these step-by-step commands to restore server storage:

Step 1: Vacuum Systemd Journal Logs

Check current journal log disk usage:

sudo journalctl --disk-usage

Vacuum journal logs to retain only the last 3 days or maximum 1GB:

# Vacuum by age
sudo journalctl --vacuum-time=3d

# Vacuum by size
sudo journalctl --vacuum-size=1G

Configure persistent journal retention limit in /etc/systemd/journald.conf:

[Journal]
SystemMaxUse=1G

Step 2: Clean APT Package Archives & Autoremove Unused Packages

# Remove all cached .deb installers from /var/cache/apt/archives
sudo apt-get clean

# Remove orphaned dependency packages and old kernel headers
sudo apt-get autoremove --purge -y

# Clean orphan package configs
sudo dpkg --purge $(dpkg -l | awk '/^rc/ {print $2}')

Step 3: Prune Unused Docker Containers, Images & Volumes

# Prune stopped containers, dangling images, unused networks, and build cache
sudo docker system prune -a --volumes -f

# Inspect remaining Docker storage usage
sudo docker system df

Step 4: Clear Systemd Core Dumps

# Delete process core memory dumps
sudo rm -rf /var/lib/systemd/coredump/*

Step 5: Prune Old Snap Package Revisions

Set Snap retention limit to max 2 revisions:

sudo snap set system refresh.retain=2

Remove disabled snap packages script:

sudo snap list --all | awk '/disabled/{print $1, $3}' | while read snapname revision; do
    sudo snap remove "$snapname" --revision="$revision"
done

Step 6: Clear Compressed Log Archives (/var/log/*.gz)

# Delete rotated log archives older than 7 days
sudo find /var/log -type f -name "*.gz" -delete
sudo find /var/log -type f -name "*.1" -delete

Master Linux Server Cleanup Script

Copy and save as server-cleanup.sh:

#!/usr/bin/env bash
set -e

echo "🚀 Starting Master Linux Server Cleanup..."

# 1. Vacuum Journalctl
echo "🧹 Vacuuming systemd journal logs to 1GB..."
journalctl --vacuum-size=1G

# 2. APT Package Cleanup
echo "🧹 Cleaning APT package cache..."
apt-get clean
apt-get autoremove --purge -y

# 3. Docker Cleanup
if command -v docker &> /dev/null; then
    echo "🧹 Pruning Docker containers and images..."
    docker system prune -a --volumes -f
fi

# 4. Core Dumps
echo "🧹 Clearing systemd core dumps..."
rm -rf /var/lib/systemd/coredump/*

# 5. Rotated Logs
echo "🧹 Clearing old compressed logs..."
find /var/log -type f -name "*.gz" -delete

echo "🎉 Linux Server Cleanup Complete! Current Disk Space:"
df -h /

Linux Server Safety & Impact Matrix

Frequently Asked Questions (FAQ)

Will running apt-get clean break my running services?

No. apt-get clean only deletes downloaded .deb installer archives stored in /var/cache/apt/archives. Installed software binaries remain 100% intact.

How do I locate large hidden files taking up space on Linux?

Run the ncdu utility or use du:

sudo du -ahx / | sort -rh | head -n 20

Related Linux Master Guides

• Learn about cleaning systemd journalctl.
• How to manage /var/tmp.