topic Re: /var/log/jail Folder in Firewall and Security Management

/var/log/jail Folder

Jason_Grubbs — Thu, 21 Oct 2021 12:58:37 GMT

We have a 5200 R80.40 that is running out of space in /var/log:

I found that there was a jail folder located inside of /var/log:

Further digging resulted in finding 37G of files located in the following folder:

/var/log/jail/opt/CPsuite-R80.40/fw1/dlp/ftp/

This firewall does not have DLP enabled

Any ideas if these files are ok to delete?

Re: /var/log/jail Folder

the_rock — Thu, 21 Oct 2021 13:09:43 GMT

I would definitely back them up first, but seems safe to remove from what I see in my lab.

Re: /var/log/jail Folder

Jason_Grubbs — Thu, 21 Oct 2021 13:17:51 GMT

Is the /var/log/jail folder even necessary? Why was it created?

Re: /var/log/jail Folder

the_rock — Thu, 21 Oct 2021 13:20:20 GMT

Do they use MTA for DLP/Email Security/AV?

That would possibly explain the use of that particular log folder.

Re: /var/log/jail Folder

Jason_Grubbs — Thu, 21 Oct 2021 13:21:54 GMT

We use AV with the Threat Prevention blade.

Re: /var/log/jail Folder

Jason_Grubbs — Thu, 21 Oct 2021 13:22:40 GMT

Re: /var/log/jail Folder

the_rock — Thu, 21 Oct 2021 13:23:28 GMT

That might explain it...honestly, I would verify with TAC, because I see that folder in my lab as well, but I dont use any of those blades, so not 100% sure.

Re: /var/log/jail Folder

Jason_Grubbs — Thu, 21 Oct 2021 13:35:52 GMT

Ok, I will reach out to TAC

Re: /var/log/jail Folder

the_rock — Thu, 21 Oct 2021 13:39:17 GMT

Definitely better to get an official answer, because if I were you, I would certainly be a bit worried about removing stuff thats 37 GB in size, specially if Im not 100% sure the purpose for it. I mean, as I stated before, I would backup everything from that folder anyway first, but let support clarify for you beforehand. In my lab, that folder is only few MBs, so there is certainly something in your environment causing the folder to fill up rather quickly.

Andy

Re: /var/log/jail Folder

Tal_Paz-Fridman — Sun, 24 Oct 2021 12:35:21 GMT

After consulting R&D, the issue is known and is handled in two parts – one is already integrated into R80.40 Ongoing Take 126.

The other fix will be included in the next JHF.

@pavelko

Re: /var/log/jail Folder

genisis__ — Sun, 24 Oct 2021 12:53:12 GMT

Can you expand? Is there a SK?

Re: /var/log/jail Folder

the_rock — Sun, 24 Oct 2021 12:56:56 GMT

I agree with @genisis__ . SK would be nice...also, considering that @Jason_Grubbs has 37 GB worth of space there (which is pretty significant), it poses a question if its really safe to remove in the first place.

Re: /var/log/jail Folder

Tal_Paz-Fridman — Sun, 24 Oct 2021 14:43:30 GMT

I also agree. I asked R&D owner to publish an SK including instructions on how to clear up the space.

Re: /var/log/jail Folder

genisis__ — Sun, 24 Oct 2021 16:53:29 GMT

100%!

Re: /var/log/jail Folder

Jason_Grubbs — Tue, 04 Oct 2022 17:22:10 GMT

I have not yet seen an SK for this issue. Still exists in R81. I had to remove another 36GB today from the jail folder.