topic Re: cpm_doctor files taking up space in Firewall & Security Management

cpm_doctor files taking up space

Roy_Smith — Thu, 25 Mar 2021 07:54:33 GMT

I have a Smartevent appliance, which starts to run out of space on /var/log. Upon investigating, there are files being created in the /var/log/opt/CPsuite-R80.40/fw1/log/cpm_doctor folder. Every few days, in this folder, there appears a new .tgz file which is 45G in size.

This has happened a few times and all I do is delete the files to clear space but the files just get re-created every few days. I assume this is some sort of diagnostics running.

So, can anyone tell me how to stop this from running, so I don't keep running out of space every few months?

Many thanks
Roy

Re: cpm_doctor files taking up space

shovalm — Thu, 25 Mar 2021 09:07:17 GMT

Hi Roy,

Can you share the output of this command : ls -ltr /var/log/opt/CPsuite-R80.40/fw1/log/cpm_doctor ?

In addition, do you have Jumbo installed ? If so - which take ?

Thanks,
Shoval.

Re: cpm_doctor files taking up space

Roy_Smith — Thu, 25 Mar 2021 10:04:18 GMT

Hi Shoval

We are on take89. and the output for the ls command is:

# ls -ltr /var/log/opt/CPsuite-R80.40/fw1/log/cpm_doctor
total 1153040504
-rw-rw---- 1 admin root 298299 Jan 25 23:30 cpm_doctor_report25_01_2021-11_30_03.ser
-rw-rw---- 1 admin root 418059 Jan 25 23:30 cpm_doctor_report25_01_2021-11_30_03.html
-rw-rw---- 1 admin root 49146892817 Jan 26 00:14 cpm_doctor_report25_01_2021-11_30_03.tgz
-rw-rw---- 1 admin root 297627 Jan 28 23:30 cpm_doctor_report28_01_2021-11_30_06.ser
-rw-rw---- 1 admin root 417724 Jan 28 23:30 cpm_doctor_report28_01_2021-11_30_06.html
-rw-rw---- 1 admin root 49147033336 Jan 29 00:14 cpm_doctor_report28_01_2021-11_30_06.tgz
-rw-rw---- 1 admin root 297647 Jan 30 23:30 cpm_doctor_report30_01_2021-11_30_03.ser
-rw-rw---- 1 admin root 417722 Jan 30 23:30 cpm_doctor_report30_01_2021-11_30_03.html
-rw-rw---- 1 admin root 49147113595 Jan 31 00:16 cpm_doctor_report30_01_2021-11_30_03.tgz
-rw-rw---- 1 admin root 297804 Feb 2 23:30 cpm_doctor_report02_02_2021-11_30_06.ser
-rw-rw---- 1 admin root 417806 Feb 2 23:30 cpm_doctor_report02_02_2021-11_30_06.html
-rw-rw---- 1 admin root 49147247001 Feb 3 00:14 cpm_doctor_report02_02_2021-11_30_06.tgz
-rw-rw---- 1 admin root 417728 Feb 4 23:30 cpm_doctor_report04_02_2021-11_30_03.html
-rw-rw---- 1 admin root 297671 Feb 4 23:30 cpm_doctor_report04_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 49147330642 Feb 5 00:16 cpm_doctor_report04_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 297656 Feb 6 23:30 cpm_doctor_report06_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 417733 Feb 6 23:30 cpm_doctor_report06_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49147406798 Feb 7 00:16 cpm_doctor_report06_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 296095 Feb 8 23:30 cpm_doctor_report08_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 416946 Feb 8 23:30 cpm_doctor_report08_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49146111642 Feb 9 00:15 cpm_doctor_report08_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 296531 Feb 10 23:30 cpm_doctor_report10_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 417166 Feb 10 23:30 cpm_doctor_report10_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49146198969 Feb 11 00:15 cpm_doctor_report10_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295574 Feb 12 23:30 cpm_doctor_report12_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 416686 Feb 12 23:30 cpm_doctor_report12_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49146314258 Feb 13 00:13 cpm_doctor_report12_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295210 Feb 15 23:30 cpm_doctor_report15_02_2021-11_30_06.ser
-rw-rw---- 1 admin root 416517 Feb 15 23:30 cpm_doctor_report15_02_2021-11_30_06.html
-rw-rw---- 1 admin root 49146441611 Feb 16 00:13 cpm_doctor_report15_02_2021-11_30_06.tgz
-rw-rw---- 1 admin root 295057 Feb 19 23:30 cpm_doctor_report19_02_2021-11_30_07.ser
-rw-rw---- 1 admin root 416436 Feb 19 23:30 cpm_doctor_report19_02_2021-11_30_07.html
-rw-rw---- 1 admin root 49146612749 Feb 20 00:15 cpm_doctor_report19_02_2021-11_30_07.tgz
-rw-rw---- 1 admin root 295061 Feb 22 23:30 cpm_doctor_report22_02_2021-11_30_06.ser
-rw-rw---- 1 admin root 416439 Feb 22 23:30 cpm_doctor_report22_02_2021-11_30_06.html
-rw-rw---- 1 admin root 49146731663 Feb 23 00:14 cpm_doctor_report22_02_2021-11_30_06.tgz
-rw-rw---- 1 admin root 295729 Feb 26 23:30 cpm_doctor_report26_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 416749 Feb 26 23:30 cpm_doctor_report26_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49146916689 Feb 27 00:13 cpm_doctor_report26_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295185 Feb 28 23:30 cpm_doctor_report28_02_2021-11_30_03.ser
-rw-rw---- 1 admin root 416511 Feb 28 23:30 cpm_doctor_report28_02_2021-11_30_03.html
-rw-rw---- 1 admin root 49146982404 Mar 1 00:15 cpm_doctor_report28_02_2021-11_30_03.tgz
-rw-rw---- 1 admin root 297876 Mar 2 23:30 cpm_doctor_report02_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 417860 Mar 2 23:30 cpm_doctor_report02_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49146947602 Mar 3 00:14 cpm_doctor_report02_03_2021-11_30_03.tgz
-rw-rw---- 1 admin root 298526 Mar 5 23:30 cpm_doctor_report05_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 418211 Mar 5 23:30 cpm_doctor_report05_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49147100132 Mar 6 00:12 cpm_doctor_report05_03_2021-11_30_03.tgz
-rw-rw---- 1 admin root 296801 Mar 9 23:30 cpm_doctor_report09_03_2021-11_30_06.ser
-rw-rw---- 1 admin root 417353 Mar 9 23:30 cpm_doctor_report09_03_2021-11_30_06.html
-rw-rw---- 1 admin root 49147274138 Mar 10 00:14 cpm_doctor_report09_03_2021-11_30_06.tgz
-rw-rw---- 1 admin root 295288 Mar 14 23:30 cpm_doctor_report14_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 416591 Mar 14 23:30 cpm_doctor_report14_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49146142796 Mar 15 00:12 cpm_doctor_report14_03_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295254 Mar 16 23:30 cpm_doctor_report16_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 416580 Mar 16 23:30 cpm_doctor_report16_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49146223361 Mar 17 00:13 cpm_doctor_report16_03_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295653 Mar 19 23:30 cpm_doctor_report19_03_2021-11_30_05.ser
-rw-rw---- 1 admin root 416231 Mar 19 23:30 cpm_doctor_report19_03_2021-11_30_05.html
-rw-rw---- 1 admin root 49146345635 Mar 20 00:12 cpm_doctor_report19_03_2021-11_30_05.tgz
-rw-rw---- 1 admin root 98315864489 Mar 20 01:47 diff_19_03_2021+18_03_2021.tgz
-rw-rw---- 1 admin root 295805 Mar 22 23:30 cpm_doctor_report22_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 416316 Mar 22 23:30 cpm_doctor_report22_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49146467740 Mar 23 00:13 cpm_doctor_report22_03_2021-11_30_03.tgz
-rw-rw---- 1 admin root 295825 Mar 24 23:30 cpm_doctor_report24_03_2021-11_30_03.ser
-rw-rw---- 1 admin root 416318 Mar 24 23:30 cpm_doctor_report24_03_2021-11_30_03.html
-rw-rw---- 1 admin root 49146546975 Mar 25 00:14 cpm_doctor_report24_03_2021-11_30_03.tgz

Re: cpm_doctor files taking up space

shovalm — Thu, 25 Mar 2021 11:43:09 GMT

Thanks Roy.

For avoiding keeping so many files to be created under this directory please replace the cpm doctor script under $MDS_FWDIR/scripts with the script that I attached. Latest cpm doctor script include a fix to this issue.
Please add execute permission to the file.

Waiting for your updates,
Shoval.

Re: cpm_doctor files taking up space

shovalm — Thu, 25 Mar 2021 11:46:06 GMT

The script wasn't attached properly due its extension (.sh).

Can you share your email so I can send it to you offline ?

Re: cpm_doctor files taking up space

Roy_Smith — Thu, 25 Mar 2021 12:15:37 GMT

Hi Shoval

Can you attach it without the extension?

Re: cpm_doctor files taking up space

shovalm — Thu, 25 Mar 2021 12:39:08 GMT

I've tried with no success.

Also changing its extension to 'txt' doesn't help, since it recognize that file's content is different.

Re: cpm_doctor files taking up space

Roy_Smith — Thu, 25 Mar 2021 12:46:43 GMT

Just sent you a PM

Re: cpm_doctor files taking up space

Carl_Neidhardt1 — Sun, 16 May 2021 14:03:47 GMT

Hello Shoval, I have the same problem with many large cpm_doctor files filling up a standalone, non-MDS R80.40 system. Can I get the updated cpm_doctor script? Or, is it rolled into a certain jumbo? Thanks!

Re: cpm_doctor files taking up space

S_E_ — Tue, 18 May 2021 10:15:22 GMT

Hello Shoval, We have exactly the same problem with many large cpm_doctor files filling up MDS R80.40 system (JHF T91).

Can we get the updated cpm_doctor script?

Not sure why the -h parameter does not show the version of the file. But I guess it might be cpm doctor build version 193

Regards

Re: cpm_doctor files taking up space

liorai — Wed, 19 May 2021 14:09:57 GMT

Hey,

My name is Liora Ifraimov and I’m from Checkpoint Management R&D.

I would like to clarify and update that we are aware of this issue -

In some edge case scenarios, historic data related to CPM Doctor is not deleted.

The issue is resolved in CPM Doctor starting from version 303. Please contact Checkpoint support to get the latest CPM Doctor version.

Till then and as an immediate solution, you can delete all data under /var/log/opt/CPsuite-R80.40/fw1/log/cpm_doctor/ and $FWDIR/tmp/cpm_doctor/log/

Feel free to ask me more questions,
Liora