topic Re: Snapshot question in Firewall and Security Management

Snapshot question

the_rock — Tue, 18 Jan 2022 20:41:16 GMT

Hey guys,

I had a quick question about snapshots on the CP gateways. I had 2 snapshots on my VM fw and each one was about 15 GB and Im trying to figure out where they are stored exactly. I know this was probably asked before, but I cant see disk space change even if you delete the snapshots.

Found below, but could not locate either snapshot in /var/log/CPsnapshot/snapshots OR /var/CPsnapshot/snapshots

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92261&partition=Basic&product=Quantum

If someone could confirm, would be great!

Thanks as always!

Re: Snapshot question

genisis__ — Tue, 18 Jan 2022 20:49:49 GMT

lvm_manager may help.

Re: Snapshot question

the_rock — Tue, 18 Jan 2022 20:53:08 GMT

Thank you for that...it does show unallocated space, which matches with the snapshot management page in web UI, BUT, still does not mention the directory.

Re: Snapshot question

K_montalvo — Wed, 19 Jan 2022 01:57:49 GMT

We can do remotelly for this after i finish a current project brother

Re: Snapshot question

the_rock — Wed, 19 Jan 2022 03:12:08 GMT

Yes sir 😉

Re: Snapshot question

G_W_Albrecht — Wed, 19 Jan 2022 09:35:24 GMT

On Gaia OS, snapshots are not files, but disk volumes that are stored as a disk partition, therefore the directory name is not relevant here. It is possible to view list of virtual drives by running the "lvs" command (in the Expert mode). See sk92261: Snapshot location on Gaia and SecurePlatform and sk172523: Unable to restore snapshot because CLISH shell hangs for details !

Re: Snapshot question

the_rock — Wed, 19 Jan 2022 12:04:35 GMT

Thanks G! I will check it a bit later and update.

Re: Snapshot question

the_rock — Wed, 19 Jan 2022 13:09:38 GMT

You are 100% right...my colleague and I looked at that sk first yesterday, but missed part you indicated. Thanks as always sir!

Re: Snapshot question

G_W_Albrecht — Wed, 19 Jan 2022 15:58:21 GMT

This leads to the fact that according to sk115144:

When exporting a snapshot, the Gaia OS transfers the relevant files for a snapshot to the /var/log/ partition, then compresses all files into one archive file.

For this operation, the requirement is that the free space in the /var/log/ partition is at least twice the size of the final snapshot.

😩

Re: Snapshot question

Tobias_Moritz — Mon, 24 Jan 2022 15:10:07 GMT

Regarding sk115144: If I am not wrong, you can reduce that from twice the size of the final snapshot to size of the final snapshot when you do the export (with clish) directly to a mounted remote file system (e.g NFS or CIFS). This way, the copy is done to local file system (/var/log partition) but the archive is created on the remote file system.

Instead of a mounting a remote filesystem, you can also mount some storage from a USB thumbdrive or something like that.