Fix a full disk on a cPanel server: where the space went

A cPanel box at 100 % on / fails in confusing ways: Exim freezes the queue, MariaDB refuses to write and may not restart, AutoSSL stops renewing, and WHM throws quota errors on account creation. The symptoms look like different bugs. They are one bug.

This is the triage order. Five minutes to the offender, which is almost always one of six directories.

Step 1 — Blocks or inodes

Different failures, different fixes, and df -h only shows half of it.

df -h
df -i

High Use% is a size problem — go to step 2. Healthy df -h with IUse% near 100 % is inode exhaustion: millions of tiny files, not big ones. Skip to the inode section.

Step 2 — Find the directory

du -xh --max-depth=1 / --exclude=/home/virtfs 2>/dev/null | sort -h | tail -15

Two traps. Exclude /home/virtfs — it is jailshell's per-user bind-mount tree on the same device, so du -x counts your system binaries once per jailed user. That space is not real, and rm -rf there destroys /bin on the host; use the safe teardown in jailed SSH and how VirtFS works. And check whether /backup is its own mount — plenty of servers put it on the root filesystem, so local backups eat the space the panel runs on.

The six usual suspects

/backup — cPanel's own backups

The most common cause and the fastest win. Check retention in WHM → Backup Configuration before deleting anything by hand.

du -sh /backup/* 2>/dev/null | sort -h

If you already run JetBackup, built-in backups are pure duplication — turn them off properly rather than deleting files, per disabling cPanel backups when JetBackup is doing the work.

MySQL binary logs

/var/lib/mysql fills with *-bin.00000N files nothing consumes, usually because replication was configured once and abandoned.

mysql -e "PURGE BINARY LOGS BEFORE NOW() - INTERVAL 3 DAY;"

Then set an expiry so it does not come back: binlog_expire_logs_seconds = 259200 on MariaDB 10.6+, expire_logs_days = 3 on older builds — alongside the other settings in tuning MariaDB on cPanel for shared hosting. If you run a replica, confirm it has consumed the logs first.

Logs and archived domlogs

du -sh /usr/local/cpanel/logs /var/log /etc/apache2/logs 2>/dev/null
rm -f /usr/local/cpanel/logs/archive/*.gz

The sneaky one is /home/*/logs/: accounts with log archiving enabled keep a compressed copy of every domlog, every month, forever, unless Delete each domain's archived logs at the end of each month is on in WHM → Tweak Settings.

Imunify360 cleanup storage

Malware cleanup keeps the pre-clean original of every file it touches. After a mass infection that is tens of gigabytes.

du -sh /var/imunify360/* 2>/dev/null | sort -h | tail -5

Shorten the retention window under Settings → Malware rather than deleting files — those originals are your only rollback, as covered in the malware cleanup workflow.

Softaculous backups in user homes

Softaculous writes application backups to /home/<user>/softaculous_backups by default and users forget they exist.

du -sh /home/*/softaculous_backups 2>/dev/null | sort -h | tail -10

Point new backups at a remote destination under Backup Location if this recurs.

Old kernels and package cache

dnf clean all
dnf remove --oldinstallonly --setopt installonly_limit=2 kernel

Two kernels is plenty. KernelCare servers reboot rarely, so stale kernels pile up unnoticed.

When it is inodes, not gigabytes

Count files instead of bytes:

find / -xdev -printf '%h\n' 2>/dev/null | sort | uniq -c | sort -n | tail -20

Nearly always one of:

/var/spool/exim/input — a frozen or spam-flooded queue. Do not rm it blindly; follow clearing a stuck Exim queue.
/home/<user>/mail/<domain>/<box>/new — an unread Maildir holding hundreds of thousands of bounce messages.
/var/cpanel/php/sessions/ea-php* — PHP session files, when the cleanup cron is broken.
/home/<user>/.trash — cPanel File Manager's trash. Deleted files are not gone.

Decision tree

df -h at 100%?
├─ No, but df -i is → inodes → exim queue / maildirs / php sessions / .trash
└─ Yes → du -xh --max-depth=1 / --exclude=/home/virtfs
         ├─ /backup large      → check retention, disable duplicate cpbackup
         ├─ /var/lib/mysql     → purge binlogs, set expiry
         ├─ /var/imunify360    → shrink cleanup retention
         ├─ /home large        → softaculous_backups, .trash, archived logs
         └─ /usr or /var large → log archives, package cache, old kernels

Stop it happening again

Set the disk-usage warning threshold in WHM → Tweak Settings to 85 % and make sure the contact address in Basic WebHost Manager Setup reaches a human. Then get backups off the server entirely, so freeing space is never a choice between keeping the panel up and keeping your only copy of customer data — the trade-offs are in backup strategy for cPanel hosts in 2026.

Why does df show the disk is full but du shows less used?+

A process still holds a deleted file open, so its blocks are not released. Run lsof +L1 to find it and restart that service — usually Exim, MySQL, or an Apache child whose log was deleted instead of truncated.

Is it safe to delete files in /home/virtfs to free space?+

No. It holds live bind mounts of system binaries, and a recursive delete can destroy /bin and /lib on the host. Run /usr/local/cpanel/scripts/clean_user_virtfs <user> instead — the space it appears to use is not real.

Can I delete MySQL binary logs with rm?+

Not safely. MariaDB tracks them in an index file and logs errors for files that vanish. Use PURGE BINARY LOGS BEFORE from the MySQL shell, then set binlog_expire_logs_seconds so they rotate automatically.

How do I find which cPanel account is using the most disk?+

Run du -sh /home/* | sort -h, or open WHM's View Account Disk Usage screen, which reads cached quota data and is instant even on servers with thousands of accounts.