Grading Checklist: Disk Full Root - Services Down

A good response must include:

• Ran df -h to confirm which filesystem is full
• Used du -sh /var/* | sort -rh | head to identify the largest consumers
• Checked for deleted-but-open files with lsof +L1 or lsof | grep deleted
• Identified the specific directory/files causing the issue (e.g., /var/log/, old journals, core dumps)
• Freed space safely without deleting files needed for forensics or compliance
• Restarted affected services after freeing space
• Checked inode usage with df -i (not just block usage)
• Verified log rotation is configured and functioning (logrotate -d /etc/logrotate.conf)
• Cleaned package cache and old kernels if applicable (apt autoremove, apt clean)
• Set up or verified disk space monitoring with appropriate warning thresholds (80%, 90%)
• Identified root cause (why did disk fill up -- not just what filled it)
• Proposed preventive measures (separate /var partition, log size limits, monitoring)