A full disk breaks things that look unrelated: sessions stop saving, uploads fail, the database refuses writes, and half of it returns 503. Check disk first whenever several unrelated things break at once.

df -h

Find what is using it

Work down from the root, one level at a time. This prints the ten largest things in a directory, and following the largest one down finds the cause in three or four steps.

du -h --max-depth=1 / 2>/dev/null | sort -h | tail -10

The four usual causes

  • Logs that never rotate. /var/log grows without limit if logrotate is not configured for a service that was added later.
  • Old backups on the same disk. A backup on the disk it protects is not a backup, and it is usually the biggest directory on the box.
  • Session files. Millions of tiny files in /var/lib/php/sessions - they take space and, worse, inodes.
  • A runaway error log. One repeating warning can write gigabytes in a day.

Free it safely

Do not delete a log a process is writing to. The space is not returned until the process closes the file, so the disk stays full and you have lost the log. Truncate it instead.
: > /var/log/nginx/error.log

Out of inodes, not space

If df -h shows free space but writes still fail, you have run out of inodes - too many files, whatever their size.

df -i
Set up monitoring that warns at 80%, not at 100%. A disk that fills at three in the morning takes the site down until someone wakes up; a warning at 80% is a task for the morning.