topic Re: $CPDIR/tmp/ directory is filled in Firewall and Security Management

$CPDIR/tmp/ directory is filled

Danny — Tue, 09 Jul 2019 14:50:08 GMT

We're facing an issue with several R77.30 and R80.10/R80.20 installations where $CPDIR/tmp/ directory gets filled up quickly causing:

ls -la to freeze for a while before showing the directory content
snapshot sizes to increase
EXT3-fs warning messages: ext3_dx_add_entry: Directory index full!

Check Point fixed this issue in R77.20 (sk98567), however it looks like it wasn't fully solved.

Current recommendations include manual deletions of temporary file relics (sk36754) as well as including this task within everyone's annual GAiA optimization and cleanup tasks (sk60080) or creating a cronjob to perform this automatically.

Doesn't sound like the ideal solution. What do you think?

Re: $CPDIR/tmp/ directory is filled

Vladimir — Tue, 09 Jul 2019 16:29:57 GMT

@Danny , I cannot get to the sk60080 from the link in your post.

I think that this is definitely something that require permanent solution by CP distributed via HFA.

Gaia optimization in majority of the SMB environments is not something that will likely to happen, especially on regular bases.

Re: $CPDIR/tmp/ directory is filled

Danny — Tue, 09 Jul 2019 16:47:39 GMT

I can access the link from multiple devices.

Re: $CPDIR/tmp/ directory is filled

Vladimir — Tue, 09 Jul 2019 18:15:11 GMT

Weird:

And by the way, when I am referring to SMBs, I am using the term in regards to the company sizes, not the CP appliance categorization.

Small to medium business, as defined by Gartner:

"Gartner defines SMBs by the number of employees and annual revenue they have. The attribute used most often is number of employees; small businesses are usually defined as organizations with fewer than 100 employees; midsize enterprises are those organizations with 100 to 999 employees. The second most popular attribute used to define the SMB market is annual revenue: small business is usually defined as organizations with less than $50 million in annual revenue; midsize enterprise is defined as organizations that make more than $50 million, but less than $1 billion in annual revenue."

Perhaps it's time for CP to reclassify the appliances and products using different term.

Re: $CPDIR/tmp/ directory is filled

Danny — Tue, 09 Jul 2019 18:24:04 GMT

Yes, I‘m having this issue with Check Point‘s UserCenter, too, for about 2 weeks now. Just reload the page until it loads.

Re: $CPDIR/tmp/ directory is filled

Vladimir — Tue, 09 Jul 2019 18:28:11 GMT

Thanks! it worked on 5th try.

Re: $CPDIR/tmp/ directory is filled

HeikoAnkenbrand — Tue, 09 Jul 2019 19:47:24 GMT

Hi guys,

FYI:

Please do not delete anything in the $CPDIR/tmp/ directory. One of our customers has deleted all files here. After that we had a crash of the management server and SmartConsloe.Temporary settings of the management server are stored here and also of opened SmartConsoles (R80.x) vs. SmartDashboards (R77.30).

If the SK does not help please open a TAC ticket.

Regards

Heiko

Re: $CPDIR/tmp/ directory is filled

Danny — Tue, 09 Jul 2019 22:38:19 GMT

Right. As sk60080 writes, the only files that are safe to delete after cpstop are:

$CPDIR/tmp/file*
$CPDIR/tmp/CKP_mutex*

(do NOT blindly delete other files - Check Point software will not be able to run).

Re: $CPDIR/tmp/ directory is filled

PhoneBoy — Sun, 14 Jul 2019 04:35:06 GMT

Curious if migrating the filesystem to xfs would improve this issue at all…

Re: $CPDIR/tmp/ directory is filled

_Val_ — Mon, 15 Jul 2019 07:11:16 GMT

@PhoneBoy why should it?

Re: $CPDIR/tmp/ directory is filled

PhoneBoy — Mon, 15 Jul 2019 14:55:08 GMT

The "index full" message seems like a filesystem limitation of sorts.

Re: $CPDIR/tmp/ directory is filled

biskit — Thu, 16 Jun 2022 08:02:23 GMT

For other people finding this post in the future, I also had the same issue recently on R80.30 Take 19. Billions upon billions of 0 byte CHK_mutex files in $CPDIR/tmp which posed quite a challenge viewing and deleting. I'm pleased to say after upgrading to R81.10 this isn't happening any longer 😀