topic Re: active cluster member full partition in Firewall and Security Management

active cluster member full partition

Rodrigo_Mezetti — Sat, 15 Feb 2025 22:53:19 GMT

Gentlemen... people... I hope you are all well?!? I would like to share a situation that has been happening to someone where the active member of the r81.10 take 172 cluster,appliance series 7000 gradually fills the /var/log partition of the fw gw until it is almost full and when it is full, it starts deleting and freeing up the partition. I have only been following all hours this behavior and it soon returns to normal and goes months without happening. Have you ever experienced this? Any experience in this regard?

tks rodrigo

Re: active cluster member full partition

the_rock — Sun, 16 Feb 2025 00:04:36 GMT

Hey Rodrigo,

Maybe there is cron job you might not be aware of possibly? I had seen that dir fill up, but then most people just delete whatever is not needed.

Example, say you wish to look for files bigger than 500 MBs, you would run -> find /var/log -size +500M

Best,

Andy

Re: active cluster member full partition

the_rock — Mon, 17 Feb 2025 02:09:21 GMT

One thing I thought of as well is check to make sure maybe there are no files from before that are "lingering" in that dir that could be deleted.

Andy

Re: active cluster member full partition

emmap — Mon, 17 Feb 2025 05:11:20 GMT

It sounds like it's logging locally, is it having trouble communicating with its configured log servers?

Re: active cluster member full partition

AkosBakos — Mon, 17 Feb 2025 09:16:43 GMT

Hi @Rodrigo_Mezetti

What does this command say?

cpstat mg -f log_server // on SmartCenter
cpstat fw -f log_connection // on gateway

Akos

Re: active cluster member full partition

Rodrigo_Mezetti — Mon, 17 Feb 2025 11:49:40 GMT

Hello.. How are you?!? The output of the command in fw (cpstat fw -f log_connection)
is informing that one of the logservers is unavailable and is saving locally (the VM is actually turned off and being migrated to another environment) and I had not removed the logserver from the log sending configurations of the clusters. I removed it now and just left the logserver active until the migration is finished and I will follow up on the case.
For now, thank you very much.

Re: active cluster member full partition

the_rock — Mon, 17 Feb 2025 12:17:45 GMT

Sounds like what @emmap mentioned was indeed the case.

Andy