@Richard Wheeler if you left the sandbox idling then for sure it MUST be the logs generated in /var/logs/{component}/ the HDP components continually generate logs with the components statuses and on the sandbox, it's mount on / # du -a /var/log/ | sort -n -r | head -n 20 Sample output 3363560 /var/log/ 1966344 /var/log/kafka 494300 /var/log/ambari-metrics-collector 267092 /var/log/hadoop 265560 /var/log/hadoop/hdfs 171528 /var/log/hadoop/hdfs/hadoop-hdfs-namenode-test.tarta.se.log 159432 /var/log/ambari-agent 98756 /var/log/ambari-infra-solr 81932 /var/log/ambari-metrics-collector/ambari-metrics-collector.log.3 81932 /var/log/ambari-metrics-collector/ambari-metrics-collector.log.2 81932 /var/log/ambari-metrics-collector/ambari-metrics-collector.log.1 81928 /var/log/ambari-metrics-collector/ambari-metrics-collector.log.4 81924 /var/log/ambari-metrics-collector/ambari-metrics-collector.log.5 69956 /var/log/oozie 49116 /var/log/hbase 40056 /var/log/ranger 39136 /var/log/ranger/admin 36420 /var/log/hive 36232 /var/log/hadoop-yarn 36176 /var/log/hbase/hbase-hbase-regionserver-test.tarta.se.log So you will need to delete the old files to regain some space. You can also run discretely a script in the cron ! ... View more