Turkey (Turkish)
Germany (German)
Worldwide (English)
Area fullnessdisk capacity is measured with df -h
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
If there is space on the disk in GB but new files cannot be created, the inode may be exhausted. This guide analyzes disk capacity, inode, quota, /tmp, log, backup, mail spool, MySQL binary log, and deleted open files without causing data loss.
No space left on device
Disk quota exceeded
Can't create/write to file '/tmp/#sql...' (Errcode: 28)
Filesystem Inodes IUsed IFree IUse%
/dev/sda1 10.0M 10.0M 0 100%Linux file systems use both data blocks and inode records. Large files cannot be written when data blocks are full; new files or directories cannot be created even if disk space appears to be available when inode records are exhausted.
df -h shows the capacity of a mount point, checking only the root partition may lead to incorrect results if /home, /var, /tmp or a backup disk is a separate mount point.
df -i shows inode usage. Millions of small session, cache, mail, tmp, or malware files can consume inode and cause 500/503 errors, MySQL, and mail errors.
If a file has been deleted but a running process still holds the file descriptor open, the space will remain filled in the df output. `lsof +L1` finds this hidden space usage; the space will be freed when the process is restarted under control.
cPanel account quota is different from disk space fullness. If only one user gets Disk quota exceeded, account quota and quota database are checked; if the entire server is affected, mount fullness takes priority.
Instead of deleting the largest file, determine what it is used for. Deleting an active MySQL, mail spool, cPanel backup, or system log without control can lead to data loss and service disruption.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: The related file system cannot allocate new data or inodes.
Possible cause: Disk blocks are full, inode 100% or allocated space limit.
Meaning: Failed to retrieve data from the application or MariaDB operating system.
Possible cause: Disk/inode fullness, /tmp fullness, or quota.
Meaning: The user or group has exceeded the assigned quota limit.
Possible cause: cPanel account quota is full, quota database is faulty or user files have grown.
Meaning: File system cannot allocate inode record for new file.
Possible cause: Millions of small cache, session, mail, tmp or malicious files.
Meaning: Application cannot create file in temporary directory.
Possible cause: /tmp area/inode full, permission 1777 broken or tmpfs limit.
Meaning: The deleted file is kept open by the process.
Possible cause: After log rotation, Apache, PHP, MySQL, or another daemon may be holding an old file open.
Meaning: Package manager, could not create a MySQL or application temporary file.
Possible cause: /tmp, /var/tmp or root file system full; permission or mount noexec issue.
Meaning: The mail queue or spam messages have grown to /var/spool/exim.
Possible cause: Spam sending account, undelivered email or remote server issue.
Meaning: Insufficient space on the backup target for a new backup.
Possible cause: Retention high, failed old backups, remote target not mounted or local fallback.
Meaning: Binary log retention is not applied, causing logs to accumulate.
Possible cause: expire_logs_days/binlog_expire_logs_seconds is missing or not cleaned due to replication requirement.
Meaning: EXT file system separated blocks may only remain for the root.
Possible cause: Disk has reached critical threshold; normal users cannot use allocated space.
Meaning: File system may be mounted read-only for protection after an error.
Possible cause: Disk/I/O error, filesystem corruption, or kernel remount.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
df -hT
lsblk -fDisplays the capacity, type and disk of all mount points.
df -ihIt shows which file system has no inode left.
du -xhd1 / 2>/dev/null | sort -h | tail -n 25
du -xhd1 /var 2>/dev/null | sort -h | tail -n 25
du -xhd1 /home 2>/dev/null | sort -h | tail -n 25Finds parent directories that increase the space within the same file system
find /var /home -xdev -type f -size +500M -printf '%s %p\n' 2>/dev/null | sort -n | tail -n 50 | numfmt --field=1 --to=iecLists large files over 500 MB by size.
for d in /var/* /home/*; do [ -d "$d" ] && printf '%10s %s\n' "$(find "$d" -xdev -type f 2>/dev/null | wc -l)" "$d"; done | sort -n | tail -n 30Inode-consuming parent directories are sorted by file count.
lsof +L1 2>/dev/null | sort -k7 -n | tail -n 50Shows files that are kept open by the process despite being deleted.
du -xsh /var/spool/exim /backup /home/*/backup* 2>/dev/null
exim -bpc 2>/dev/nullExim checks the size of the queue and common backup locations.
du -xsh /var/lib/mysql 2>/dev/null
find /var/lib/mysql -maxdepth 1 -type f -printf '%s %p\n' 2>/dev/null | sort -n | tail -n 30 | numfmt --field=1 --to=iecLists large log and data files in the MariaDB data directory.
First, determine the correct mount point and type of usage; then find the service or account that caused the growth, perform a secure cleanup and prevent it from happening again.
df -h shows disk capacity and df -i shows inode, determine which mount point the error message is referring to.
df -hT
df -ih
df -hT /tmp /var /home /backup 2>/dev/nullUse -xdev with find commands to locate the original source without moving between mounts.
du -xhd1 /var 2>/dev/null | sort -h | tail -n 25Before deletion, determine which service or cPanel account the file belongs to, and whether it is active or not, and if a backup exists or not.
stat /YOL/DOSYA
lsof /YOL/DOSYA 2>/dev/nullLogs should be cleaned with logrotate, MySQL binary logs with the SQL PURGE command, cPanel backups with the retention setting, and mail queue analysis.
logrotate -d /etc/logrotate.conf 2>&1 | tail -n 80Restart the service that owns the large file in lsof +L1 output using the cPanel script or systemctl.
lsof +L1 2>/dev/null | sort -k7 -n | tail -n 30Prevent recurrence by adjusting WHM disk usage thresholds, backup retention, logrotate, and MySQL binary log time.
df -hT
df -ihThe most likely cause is inode percentage 100 or account quota. Compare the output of df -i and repquota.
df -ih
repquota -a 2>/dev/null | head -n 80The process may be holding onto the deleted file. Find the PID with lsof +L1 and restart the related service under control.
lsof +L1 2>/dev/null | sort -k7 -n | tail -n 50The account that sent spam messages, frozen messages, and delivery errors are identified before clearing the queue. If the root cause is not resolved, the queue will replenish.
exim -bpc
exim -bp | exiqsumm | head -n 60If replication is used, the slave position is verified. Safe cleanup is done from within MariaDB using PURGE BINARY LOGS.
mysql -e "SHOW BINARY LOGS; SHOW VARIABLES LIKE 'binlog_expire_logs_seconds';"Data may have been written to the local directory when the remote target was not mounted. Retention, incomplete backups, and remote transport logs are checked.
mount | grep -E '/backup|backup'
du -h --max-depth=2 /backup 2>/dev/null | sort -h | tail -n 30It shows that there are no data blocks or inodes left in the related file system. The path where the error occurred should be checked at the mount point using df -h and df -i.
Inode can be 100% or user quota is full. Disk capacity and inode are separate resources.
File system metadata record for each file and directory. A large number of small files can consume inodes before disk space runs out.
find ile üst dizinler altındaki dosya sayıları karşılaştırılır. Cache, session, mail ve tmp klasörleri özellikle incelenir.
A running process might be keeping the deleted file open. It can be detected using lsof +L1 and the related service will be restarted when the area is freed.
No. MariaDB's log index may be corrupted and replication may be affected. The SHOW BINARY LOGS and PURGE BINARY LOGS commands must be used.
No. The account quota shows the allowed usage of a single user, df shows the physical capacity of the entire file system.
It varies depending on the load; however, a safe share should be allocated to produce alarms before reaching the critical threshold for database, log, and backup growth.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.