How to troubleshoot a full disk on a Linux server without just deleting logs immediately

When a server disk is full, the worst thing you can do is start deleting logs randomly. You might free up space, but if you need to investigate an incident later, the evidence will be gone. I usually start by confirming which partition is full; don't just look at df -h and start working. My troubleshooting sequence starts with checking large directories: /var/log, Docker overlay, database…