Logs, temporary files, and mounts

Linux stores changing system data in several places. Knowing what each directory represents helps you investigate a full disk without deleting active data blindly.

Traditional text logs usually live under /var/log. Services managed by systemd often send structured messages to the journal instead:

sudo journalctl -u nginx --since today

Some applications use both. Check the service configuration before assuming a log is missing.

Temporary directories are not permanent storage

/tmp contains short-lived temporary data. /var/tmp is intended to survive longer, often across reboots, but it is still temporary.

Cleanup policies vary. A scheduled service can remove old files while your application still expects them. Store durable uploads and application state in an intentional data directory, not in /tmp.

Before deleting a temporary file, find which process uses it:

sudo lsof /tmp/suspicious-file

A mount changes what a path points to

A mounted filesystem appears at an ordinary directory. Use findmnt to see the real relationship:

findmnt
findmnt /var/lib

df -h reports capacity by filesystem:

df -h

du adds the visible files under a directory:

sudo du -xhd1 /var | sort -h

The -x option stays on one filesystem. This prevents the command from walking through other mounts by accident.

When df and du disagree

A process can keep a deleted file open. The directory entry disappears, so du no longer sees it, but the filesystem keeps the data until the process closes the file.

Find deleted open files with:

sudo lsof +L1

Restart or reload the owning service only after you understand the impact. Do not delete random files from /var/lib; that directory often contains live databases and package state.

Try this: use findmnt, df -h, and du -xhd1 on a test machine. Explain why each command answers a different question.