The root filesystem is full; do not start deleting logs

/ hits 100% and services start failing. Deleting logs in a hurry breaks something else; work in order.

du -x -h --max-depth=1 / | sort -h locates the top-level directory without crossing filesystems. The usual suspects: /var/log, /var/lib/docker, /var/cache/apt, /tmp, and the application's own data.

Safe to clear immediately: apt clean, journalctl --vacuum-size=200M, /tmp files older than a week, old rotated .gz logs.

Do not delete: logs being written (truncate instead), database files, Docker's overlay directories (use docker system prune).

And check lsof +L1 for deleted-but-open files — that space only returns when the process restarts. Afterwards, ask why it filled: rotation broken, or something writing in a loop.