High root partition usage and commit issues due to dangling file descriptors

• Commit issues
• System log shows "Disk usage for / exceeds limit, xx percent"
• High disk utilization on the root partition (/dev/root) when checking disk space:

  > show system disk-space 
  
  Filesystem      Size  Used Avail Use% Mounted on
  /dev/root       7.9G  7.0G  483M  94% / <<<<<<<
  none             16G  108K   16G   1% /dev
  /dev/sda5        24G  7.5G   15G  34% /opt/pancfg
  /dev/sda6       5.8G  3.2G  2.4G  57% /opt/panrepo
  tmpfs            16G  515M   16G   4% /dev/shm
  tmpfs            12M   40K   12M   1% /opt/pancfg/mgmt/ssl/private
  cgroup_root      16G     0   16G   0% /cgroup
  /dev/sda8        32G   19G   12G  63% /opt/panlogs
  /dev/loop0       13G  915M   11G   8% /opt/mongobuffer
  tmpfs            32M     0   32M   0% /mnt/pantmp

• Any Palo Alto Networks Firewall or Panorama
• Any PAN-OS version

High root partition usage can be caused by dangling file descriptors (FDs). Dangling FDs occur when a process holds an open file handle to a file or resource that has been deleted or unlinked from the filesystem. The kernel maintains access to the data until the process closes the descriptor, leading to hidden disk usage, which is most often associated with log files.

1. Check if dangling FDs exist by executing the command below:

> debug software disk-usage dangling-fds

Deleted files on slot 0 mp
===========================
  File: /proc/12718/fd/3 -> /opt/plugins/var/log/pan/plugin_client.log.2 (deleted)
  Size: 64              Blocks: 0          IO Block: 1024   symbolic link
Device: 4h/4d   Inode: 367264      Links: 1
Access: (0300/l-wx------)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-02-16 15:42:37.435082797 +0000
Modify: 2026-02-09 15:33:31.552803867 +0000
Change: 2026-02-09 15:33:31.552803867 +0000
 Birth: -
236K    /proc/12718/fd/3

2. Identify the process ID (PID) causing the dangling FDs from the command output. In the above output, process ID 12718 has dangling FDs
3. Execute show system software status | match <PID> (replacing <PID> with the actual process ID) to identify the specific process holding the open file handle
4. There are two options to release the disk space associated with these files that are accessible from the normal CLI, both of which should only be performed during a maintenance window as process restarts affect operations:
   1. Restart the associated process
   2. Restart the device

If it is not possible to schedule a maintenance window to restart the process/device and the issue is already impacting operations then open a TAC support case requesting for an engineer to login to the root shell and empty the files hogging the disk space manually until a restart can be scheduled (reduces the size of the file to 0 by deleting its contents).