topic Re: Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp in Firewall and Security Management

Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp

Filip_Wennerhul — Thu, 18 Apr 2019 08:32:07 GMT

Hi, anyone had an issue with not /var/log/opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/dlp not being cleaned.

The customer are running MTA and Sandblast remote emulation and this is filling up on the gateway. No sandblast agent. There is this sk117634

This is an improved script that probably will help but i would like to know why the orignal script is failing. How long does it take between cleaning the directory (1 month or longer?). Can i see some logs regarding the execution of this script, if its failing to execute?

I found this script teCleanupOldFiles.elg

Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/te_files/ ...
Thu Apr 18 10:17:32 CEST 2019: Above threshold (27%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: Aquired lock, calling cleanupDirectory /tmp/ 4320 0 /tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/te/te_tmp_files/ ...
Thu Apr 18 10:17:32 CEST 2019: cleanupDirectory _filesPattern is /tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz
Thu Apr 18 10:17:32 CEST 2019: STARTING cleanup...
Thu Apr 18 10:17:32 CEST 2019: Above threshold (27%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: running command: find /tmp/ -mindepth 1 -maxdepth 1 -cmin +4320 -print | grep -P "/tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz" | xargs -d '\n' rm -rf
Thu Apr 18 10:17:32 CEST 2019: Try acquire lock, on directory /var/log/py/jail/raw_files
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /var/log/mal_files/ ...
Thu Apr 18 10:17:32 CEST 2019: Aquired lock, calling cleanupDirectory /var/log/py/jail/raw_files 1440 0
Thu Apr 18 10:17:32 CEST 2019: cleanupDirectory _filesPattern is
Thu Apr 18 10:17:32 CEST 2019: Above threshold (16%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /tmp/ ...

but this does not seem to include this directory.

Can anyone help me find out why the original script is failing. This started happen recently without any noticable change.

regards

Re: Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp

Nick_Doropoulos — Thu, 18 Apr 2019 12:54:52 GMT

Hi Filip,

I'm afraid that the sk you mention is only visible to customers...

Re: Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp

G_W_Albrecht — Thu, 18 Apr 2019 13:34:27 GMT

sk117634 is only one sk about such issues:

But what i do not understand is why you would like to know why the orignal script is failing. I am sure there is a reason, some people will even call it a bug, but for me it is most valuable to get a solution to the customers issue. An explanation may be fine, but how could it help you in this case ?

In sk117634, we read: There is a Python script on Security Gateway that runs periodically and is responsible for removing old temporary files that were not cleaned by the regular e-mail flow. However, in case the list of temporary files is getting too long until the next call to this script, it would fail to delete them, and the list of files would get bigger over time.

Does that not explain enough ?

Re: Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp

Filip_Wennerhul — Thu, 25 Apr 2019 07:16:51 GMT

Okey, you have a point. I will accept this solution and add the script according to SK.