When our monitoring alerts us of a server because of a full root file system, determining the cause is a bit harder than with other file systems because many directories under / are actually mount points of separate file systems.

There is an easy way to isolate the root file system content, though: mounting it a second time elsewhere.

A normal mount will fail:

mount: /dev/mapper/vg0-root already mounted or /mnt busy
mount: according to mtab, /dev/mapper/vg0-root is mounted on /

But a bind mount does the trick:

$ mount --bind / /mnt
$ du -sh /mnt/*