Skip to content

Diagnosing Disk Space Alerts

General triage for a Netdata disk_space alert on any fleet host. This is the article the n8n "Enrich Alert" node's disk_space enrichment links to — previously it pointed at snapraid-mergerfs-setup, which documents one specific storage layout (SnapRAID + mergerfs) and has nothing to do with triaging a general low-disk-space alert on an arbitrary host. That mismatch was flagged in n8n-Active-Workflows.md on 2026-09-21 and fixed as part of the 2026-09-23 Enrich Alert audit.

First: find the full mount

df -h

Look at Use% across every mount, not just /. A full /var or /home on a separate partition won't show up if you only glance at the root filesystem.

Find what's actually using the space

du -sh /* 2>/dev/null | sort -rh | head -20

Run it again one level deeper inside whichever top-level directory is largest (du -sh /var/* | sort -rh | head -20, etc.) to narrow down further.

Common culprits on this fleet

  • Journal growth — journalctl --disk-usage shows total size; journalctl --vacuum-size=500M reclaims space. Persistent journals on a host that's been up a long time are a frequent cause.
  • Old logs — check /var/log for rotated logs that never got cleaned up (*.log.1, *.gz, application-specific log directories).
  • Docker — on Docker hosts (majorlab), docker system df shows space used by images, containers, volumes, and build cache. docker system prune -a reclaims it, but review docker system df -v first if anything running is unexpected — prune is destructive to stopped containers and unused images/volumes.
  • Stale backups or scratch space — restic/B2 backup clients and any local staging directories they use before upload.
  • Windows/WSL2 hosts (MajorRig) — the WSL2 filesystem surfaces NTFS volumes, so du/df inside WSL can be slow or misleading for large trees. Check from Windows directly with Get-PSDrive C and size folders with Get-ChildItem <dir> -Recurse -Force -File | Measure-Object Length -Sum. Recurring culprits: Steam libraries, stream archives under Videos, backup-client scratch under C:\ProgramData.

If the array itself is full (SnapRAID/mergerfs hosts)

If the host uses the SnapRAID + mergerfs layout (majorhome), see snapraid-mergerfs-setup for pool-specific commands (mergerfs.balance, per-disk usage, parity implications). That article is the right reference only when the alert is specifically about the mergerfs pool, not for a generic single-disk disk_space alert.