How to Clear Logs and Temporary Files in Linux Safely and Free Disk Space

Key takeaways

• Diagnose first with df -h and du; do not delete blindly.
• journalctl --vacuum-size and --vacuum-time trim the systemd journal safely.
• Truncate an active log with truncate -s 0 instead of deleting it, so the service keeps writing.
• Logs are evidence; deleting them to hide activity is improper and may be illegal.
• A deleted file held open by a process still uses space until the process restarts.

How do you find what is using the disk?

Do not start by deleting. First locate the space:

df -h
sudo du -xh /var --max-depth=2 | sort -h | tail -15

df -h shows which file system is full. du shows which directories are largest, and -x stops it crossing into other file systems. On a typical server, the heavy directories are /var/log, /var/cache, /var/lib (databases, containers) and /home. Also check inodes with df -i if the disk seems free but you cannot create files.

How do you clean systemd journal logs?

Modern distributions based on systemd store logs in the journal. Check its size and trim it:

journalctl --disk-usage
sudo journalctl --vacuum-size=500M
sudo journalctl --vacuum-time=14d

To limit it permanently, set SystemMaxUse=500M in /etc/systemd/journald.conf and restart systemd-journald.

What about files in /var/log?

Most services write to /var/log, and logrotate compresses and removes old copies automatically. Check its configuration in /etc/logrotate.conf and /etc/logrotate.d/. To free space from a runaway file without breaking the service:

sudo truncate -s 0 /var/log/app/big.log

Truncating keeps the file and its permissions, and the program keeps writing to it. Using rm on an open log can leave the space still in use (see below). Better still, fix the cause of the flood, such as debug logging left on.

How do you clean package caches and temporary files?

Always run the listing form of a find command first, and read the output before adding -delete. CentOS Linux is end-of-life; the same commands apply on supported rebuilds such as Rocky Linux and AlmaLinux.

Why is the disk still full after deleting a file?

If a process has a file open when you delete it, the space is not released until the process closes it. Find such files with:

sudo lsof +L1

Restart the owning service, or truncate the file through /proc/PID/fd if you cannot restart it. This is a classic cause of a disk that stays full after cleaning.

Should you ever clear logs completely?

Logs are evidence for troubleshooting, security investigations and compliance. Keep them for the period your organisation requires, ship them to a central log server, and delete only with a policy. Wiping logs to hide activity is improper and may be a crime in many circumstances, including tampering with evidence under Indian law.

Common mistakes

• Running rm -rf on /var/log or /tmp without checking what runs from them.
• Deleting an active log instead of truncating it.
• Cleaning when the real cause, a chatty application, remains.
• Forgetting that /tmp may hold files that running programs need.

Next steps

Practise these tasks with the Linux training course. Related reading: essential Linux commands for admin interviews and the most important Linux commands.