topic Re: R81.20 Management Server running ot of disk in Firewall and Security Management

R81.20 Management Server running ot of disk

VIKAS1 — Tue, 22 Jul 2025 06:11:19 GMT

Hi Team,

any suggestion how to clear the disk space, Management Server runing on R81.20 with JHF 99, with 4 gateway on clsuter mode.

Re: R81.20 Management Server running ot of disk

emmap — Tue, 22 Jul 2025 06:42:55 GMT

Check the log retention options and adjust as necessary, if it's filling with logs.

If it's not logs, check things like home directories and backup folders, make sure you don't have large files in the home folders or 3 years of weekly backups filling up the hard drive.

Re: R81.20 Management Server running ot of disk

Martijn — Tue, 22 Jul 2025 06:46:47 GMT

Hi,

Is it a physical device or a virtual device?

Did you check the knowledge base:

sk60080 - Disk space tips and tricks for Gaia OS

sk33997 - How to determine which directories and files are using a large amount of disk space

Did you check:

- Old log files ($FWDIR/log)
- Unused CPUSE packages
- CPINFO files from the past
- Migrate Export en Import files from the past
- Debug files from the past

If the machine is upgraded several times from older versions, maybe a clean install (with import) is a good idea.

Regards,
Martijn

Re: R81.20 Management Server running ot of disk

VIKAS1 — Tue, 22 Jul 2025 07:23:20 GMT

It's physical device.

i have run the below command ,

[Expert@FW-001:0]# du -sh /opt/CP* | sort -h
0 /opt/CPOtlpAgent
0 /opt/CPshared
20K /opt/CPVPNPortal
2.0M /opt/CPquid
3.7M /opt/CPDynamicContent
8.7M /opt/CPDepCon-R81.20
13M /opt/CPviewExporter
14M /opt/CPCoreUploader
15M /opt/CPinfo-10
15M /opt/CPvsec-R81.20
16M /opt/CPSamlPortal
16M /opt/CPotlpAgent
18M /opt/CPSmartLog-R81.20
20M /opt/CPR77CMP-R81.20
22M /opt/CPupgrade-tools-R81.20
25M /opt/CPR8040CMP-R81.20
26M /opt/CPR7540CMP-R81.20
26M /opt/CPcdt
27M /opt/CPR76CMP-R81.20
28M /opt/CPzetc
30M /opt/CPSDC
33M /opt/CPUserCheckPortal
38M /opt/CPupgrade-tools-R82
41M /opt/CPNacPortal
43M /opt/CPGwsOnboard
44M /opt/CPInfinityTunnel
46M /opt/CPSharedObjects
57M /opt/CPRepMan-R81.20
61M /opt/CPSFWR77CMP-R81.20
70M /opt/CPSFWR80CMP-R81.20
70M /opt/CPdiag
75M /opt/CPSFWR81CMP-R81.20
149M /opt/CPotelcol
179M /opt/CPafw
254M /opt/CPInfinityTp
254M /opt/CPbios_upg
330M /opt/CPDepInst
1.1G /opt/CPDiffReportServer
1.5G /opt/CPrt-R81.20
2.2G /opt/CPda
2.7G /opt/CPsuite-R81.20
3.1G /opt/CPInstLog
5.0G /opt/CPuepm-R81.20
5.4G /opt/CPshrd-R81.20
[Expert@FW-001:0]#

Re: R81.20 Management Server running ot of disk

Lesley — Tue, 22 Jul 2025 07:29:43 GMT

df -h output please

check also the automatic log cleanup feature. See screenshot here as example:

https://support.checkpoint.com/results/sk/sk176803

Re: R81.20 Management Server running ot of disk

VIKAS1 — Tue, 22 Jul 2025 07:32:04 GMT

Re: R81.20 Management Server running ot of disk

Chris_Atkinson — Tue, 22 Jul 2025 07:34:08 GMT

Has the machine been through multiple previous in-place upgrades?

Worth investigating the log path for those old versions if other traditional fixes don't alleviate the issue.

Re: R81.20 Management Server running ot of disk

VIKAS1 — Tue, 22 Jul 2025 07:48:16 GMT

Device has been upgraded from R81.10 to R81.20 and also recent we have updated JHF 65 to 99.

Re: R81.20 Management Server running ot of disk

VIKAS1 — Tue, 22 Jul 2025 07:49:12 GMT

[Expert@EMB-FW-001:0]# ls -l /var/log/tmp
total 12
drwxrwx--- 2 admin root 6 Jul 27 2023 HF
drwx------ 3 admin root 21 Jul 10 2024 bundle_tmpdir_CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#65_7SaMv9
-rw-rw---- 1 admin root 2672 Jul 10 2024 configurations.json
-rw-rw---- 1 admin root 37 Jul 10 2024 cpuse_blink_properties.json
-rw-rw---- 1 admin root 213 Jul 10 2024 packages_cb.txt

Re: R81.20 Management Server running ot of disk

Hugo_vd_Kooij — Thu, 24 Jul 2025 11:54:41 GMT

Some of the top directories are a a bit unexpected.

1.1G /opt/CPDiffReportServer
1.5G /opt/CPrt-R81.20
2.2G /opt/CPda
2.7G /opt/CPsuite-R81.20
3.1G /opt/CPInstLog
5.0G /opt/CPuepm-R81.20
5.4G /opt/CPshrd-R81.20

I would go over /opt/CPInstLog and see if you got ancient stuff in there.

Having said that the error could apply to ither the root or the /var/log partition.

Step 1 is to run `df -h` to understand which partition is filling up.

Re: R81.20 Management Server running ot of disk

VIKAS1 — Thu, 24 Jul 2025 12:08:44 GMT

[Expert@EMB-FW-001:0]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current 50G 48G 2.9G 95% /
/dev/sda1 290M 100M 175M 37% /boot
tmpfs 7.7G 24M 7.7G 1% /dev/shm
/dev/mapper/vg_splat-lv_log 1.6T 621G 979G 39% /var/log
cgroup 7.7G 0 7.7G 0% /sys/fs/cgroup

Re: R81.20 Management Server running ot of disk

Lesley — Thu, 24 Jul 2025 12:10:50 GMT

clish -> show snapshots

delete snapshot NAME

clean up anything you do not need. they take up a lot of space

Re: R81.20 Management Server running ot of disk

VIKAS1 — Thu, 24 Jul 2025 12:14:07 GMT

FW-001> show snapshots
Restore points:
---------------
Mgmt13062025

Creation of an additional restore point will need 50.016G
Amount of space available for restore points is 56.34G
FW-001>

Re: R81.20 Management Server running ot of disk

Lesley — Thu, 24 Jul 2025 12:24:44 GMT

delete snapshot is old

after that cd /

find . -type f -size +200000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'

find . -type f -size +2000000k -exec ls -lh {} \; | awk '{ print $9 ": " $5 }'

Re: R81.20 Management Server running ot of disk

VIKAS1 — Wed, 30 Jul 2025 09:26:15 GMT

issue resolved, after cleaning up the old log/tmp file. and also deleted some old migration file.