Finding disk usage, large files, and I/O bottlenecks
Start by separating capacity, inode, and performance problems:
df -hT
df -ih
du -xhd1 / | sort -h
find / -xdev -type f -size +1G -printf '%s %p\n' | sort -n
lsblk -fDo not delete unfamiliar files solely because they are large. Check open-but-deleted files with lsof +L1, journal retention, package caches, database logs, and container storage.
For I/O symptoms, collect vmstat 1, iostat -xz 1 when sysstat is installed, and timestamps. High wait time may come from the guest workload, memory pressure, filesystem errors, or storage contention. Preserve evidence before rebooting.