Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I receive these emails (on my cPanel Linux Cent OS 5 Server) every day and haven't a clue what they mean or what to do;

Drive Warning: /dev/root (/) is 81% full
Drive Critical: /dev/vg00/var (/var) is 92% full

How can I sort this easily? I have full root and SSH access

share|improve this question

closed as not a real question by Ignacio Vazquez-Abrams, Ward, Shane Madden, Iain, MDMarra Nov 17 '11 at 1:13

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Your drives are almost full. – Ignacio Vazquez-Abrams Sep 18 '11 at 12:01
but... of what? – James Anderson Sep 18 '11 at 12:10
Of​.​.​. files. – Ignacio Vazquez-Abrams Sep 18 '11 at 12:11
@JamesAnderson - We can't tell you "of what" based on the info here and we can't tell you what to keep and what to delete. Those are things that the person administering the server needs to know and take care of. – RobM Sep 18 '11 at 12:49
@JamesAnderson - We really can't tell you "of what". We don't have any access whatsoever(we can't even identify the server, or what disks it has), while you have full access. You are the one who is expected to know what is on there, what those files do(roughly), and why they're there. You are the one that can sort the directories by size and identify any that are growing beyond proportion. You are the one that put things there(directly, or through some daemon), and you are the one that needs to watch their size and appropriately trim them. We not only should not, but CANNOT do that for you. – Kevin M Sep 18 '11 at 19:28

Actually I was in the middle of a lengthy answer, when I realized the real answer is:

  • get some shell scripting skills
  • get an overview of directory sizes under the filesystem in question
  • get an overview of file sizes for the filesystems in question
  • for each directory and file find out to which package it belongs to
    • if it doesn't belong to a package you put it there! -- STOP! You put it there, at least you told some daemon, thru some mechanism it's ok to put it there. Or you gave some user write privileges and access. So at the end of the day you are the one who should know why the file is there in the first place.
    • if it belongs to a package and you don't know what it does either take the time and read the documentation or get help from a professional and let her explain the steps to you

Now someone please go downvote me for a harsh answer. I'm in a bad mood today anyway which I think isn't the best time to give free support on internet fora (forums? what's the plural of that word in english)

share|improve this answer
I think "forums" is correct, but lots of people use "fora" because it sounds fancier. – Ward Sep 18 '11 at 18:13

you have 2 options

continue to ignore the emails as it looks like you have done so far, this is only asking for troubles


try checking log directories and clearing out old rotated logs

check your backup isnt also being stored on your main harddrive and either copy them to another drive or ideally off the server then delete from local disk

how big is your drive and how much are your sites using of it? it may just be a plain and simple, your website files have filled and you have truly outgrown your disk (so you need a bigger one or a new server)

one other thing to check if you have stuff like cron jobs running etc and if you dont use the server for email is to check and delete mail stored on the server, for example cronjobs will send mail to the account that they run as so checking webmail in cpanel will show this and hopefully you can delete them

to check log file size

du -h --max-depth=1 /var/log

to delete files

rm -f /var/log/logfile.log

anything that has extension .gz or .(number) are more than likely safe to delete, however you may want to keep the most recent ones just in case you need to check your logs, perhaps download them from your server to your machine before you delete

share|improve this answer
how can I "try checking log directories and clearing out old rotated logs" :) – James Anderson Sep 18 '11 at 12:49
added some info that will help with that – anthonysomerset Sep 18 '11 at 15:58

Install ncdu (yum install ncdu), and run ncdu /var/log/, or you can use the following command:

# du -s /var/log/* | sort -rn | cut -f2 | xargs -d '\n' du -sh | head

to find the top biggest folder.

If you have many old rotated logs (e.g: messages.1, messages.2, ...), take a look at /etc/logrotate.d/syslog:

   /var/log/messages {
       rotate 5
           /sbin/killall -HUP syslogd

Turn down the rotate to a sane value which is how many weeks (days) you want to keep the log files.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.