topic Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value. in Firewall and Security Management

R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Thu, 01 Dec 2022 16:26:38 GMT

I logged into Smart Console yesterday late and noticed my SG3200 is sporting a red X.

Investigating I discovered under Device and License Information the error:

"Error:Disk Space usage is above allowed value."

Now normally that error would be fairly self explanatory, except it isn't in this case.

1) I do not use local threat emulation. We are using Threat Cloud. Therefore no disk limits are set.

2) Disk space on the appliance is mostly empty sitting at 22Gb free.

Logging into the SG directly, GAIA is showing no issues.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

RS_Daniel — Thu, 01 Dec 2022 19:06:52 GMT

Hello,

Can you provide output of following command? ls -l /var/log/files_repository/images

If it is not empty the emulation images are being downloaded to your local appliance, i've seen this in an appliance whith remote emulation configured (NOT locally).

Regards

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Thu, 01 Dec 2022 19:41:11 GMT

[expert@host:0]# ls -l /var/log/files_repository/images

total 0

[expert@host:0]#

hostname was edited. It is not 'host'.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Chris_Atkinson — Fri, 02 Dec 2022 01:03:05 GMT

A 3200 appliance has ~320GB storage (total) of which part is allocated to /var/log it's needs 20% free in that volume.

What's the output of "cpstat threat-emulation" on the gateway?

Refer also: sk101149 / sk92907

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

the_rock — Fri, 02 Dec 2022 00:49:28 GMT

Have a look at this sk. I would still double check the disk space on the appliance.

Andy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101149

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Blason_R — Fri, 02 Dec 2022 03:05:32 GMT

Best way I always follow - few quick trick

cd /var/log

du -hs * | grep -E 'M|G|T'

```

And it would show the usage; this would help to clear the files more conveniently.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 15:38:22 GMT

There are some large files on /var/log but I have no idea what can be cleared.

Is there an SK outlining files that can be deleted. or cat /dev/nulled?

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 15:42:19 GMT

Same as posted. Status 2 Error Disk space usage is above allowed value.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

the_rock — Fri, 02 Dec 2022 15:43:47 GMT

Are you able to send a screenshot? Blur out any sensitive info.

Andy

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 15:44:23 GMT

Screenshot of what?

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

the_rock — Fri, 02 Dec 2022 15:45:27 GMT

Large files you see in /var/log.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

the_rock — Fri, 02 Dec 2022 15:49:34 GMT

This is great command our mate @G_W_Albrecht provided in a different post:

find / -type f -size +100000 -exec ls -lh {} \; 2> /dev/null | awk '{ print $NF ": " $5 }' | sort -nk 2,2

So say to search for files bigger than 500 MB in /var/log, just run this:

find /var/log -type f -size +500000 -exec ls -lh {} \; 2> /dev/null | awk '{ print $NF ": " $5 }' | sort -nk 2,2

Andy

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 15:58:35 GMT

There is like 6 pages of files so screenshots a bit difficult. However, there is a gigantic file:

/var/log/aspose/opt/CPsuite-R81.10/fw1/aspose_jail/proc/kcore.

It is 140737486266368 in size.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

the_rock — Fri, 02 Dec 2022 16:00:01 GMT

Hm, I dont pretend to know answer to it, so I will let someone else confirm, but I found below, which does make sense.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk147912

Andy

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 16:01:27 GMT

I have a 8 versions of these as well. They are 1-5G each

/var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#69/Check_Point
_R81_JUMBO_HF_MAIN_Bundle_T69_FULL.tgz

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 16:02:51 GMT

Okay so kcores can be ignored.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 16:06:10 GMT

I suspect these can be removed but is there a process within SmartConsole for doing so?

I don't like munging around in the filesystem. Not sure why CP allows these types of conditions

to occur in the first place. I keep clean systems on the front end so I don't understand why it's

so trashy on the back side.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

Tony_Graham — Fri, 02 Dec 2022 16:11:12 GMT

This is where the .tgz files are sitting.

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

G_W_Albrecht — Fri, 02 Dec 2022 16:11:18 GMT

These are the installed Jumbo Fixes! To free this space, use a new GA Jumbo HF:

- uninstall all Jumbo takes (1 command)

- delete all uninstalled Jumbo Packages (if not visible in GAiA WebGUI, from CLI)

- install latest GA Jumbo

Re: R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

G_W_Albrecht — Fri, 02 Dec 2022 16:14:10 GMT