topic Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder in Firewall and Security Management

Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Tue, 10 Nov 2020 16:16:12 GMT

Dears,

The /tmp folder on our gateway is 17 GB in size.

It contains files like:

- temp_tar_exclude_*

- ddrOutput*

Is it save to delete those files. Or do we have to open a TAC case for this.

Thanks.

Regards,

Kris

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

HeikoAnkenbrand — Tue, 10 Nov 2020 19:59:39 GMT

Hi @Kris_Pellens

Current status information are stored in the tmp directory. If you delete the content of the directory it can lead to big problems. I would open a TAC case.

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Tue, 10 Nov 2020 20:04:21 GMT

Thank you Heiko.

Important note: your contribution to Check Mates is excellent. Much appreciated!

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kaspars_Zibarts — Wed, 11 Nov 2020 08:16:32 GMT

As far as I can see:

/tmp/temp_tar_[in|ex]clude*.txt are leftovers from backup process and there is no harm removing those:

Note that backup logs show +1hr due to silly timezone setup

Same goes to ddrOutput as that's junk from SW updates checks that are run every 3hrs by default

Interestingly my /tmp is only 100MB with all that junk in it

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kaspars_Zibarts — Wed, 11 Nov 2020 08:18:59 GMT

Have you checked the biggest files in /tmp btw?

ls -lSr /tmp

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Wed, 11 Nov 2020 08:25:44 GMT

Hi Kaspars,

Thank you for your feedback. Attached you'll find the output ls -lSr /tmp.

As you can see, there are dozens of those files which I was mentioning before.

The biggest file is:

-rw-r--r-- 1 admin root 8471503451 Nov 10 21:21 tarBkp.elg

Regards,

Kris

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Wed, 11 Nov 2020 11:14:18 GMT

Hello Kaspars,

After deleting the leftover files, the size of /tmp went from 17 GB to 8.7 GB.

The file tarBkp.elg is now consuming the most. Can we reduce the size of this file as well?

Not sure why the update leftovers are staying in /tmp? Could it be the Private ThreatCloud we are using?

Kind regards,

Kris Pellens

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kaspars_Zibarts — Wed, 11 Nov 2020 12:37:01 GMT

totally - it's only a log of files that have been added to backup and it seems to add new list every time without purging previous... I just grepped mine and saw a unique file appearing 92 (!) times on the same list. I did a test and it re-created new when running backup

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kaspars_Zibarts — Wed, 11 Nov 2020 13:01:05 GMT

@_Val_ could you pls bring this up internally with R&D that works with backups - seems to be leaving a lot of garbage in /tmp, in Kris case 17GB! That's leading to root partition exhaustion..

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

_Val_ — Wed, 11 Nov 2020 13:06:35 GMT

Let me see what I can do...

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Dov_Fraivert — Fri, 20 Nov 2020 03:52:37 GMT

Hi Kris

The following backup files can be safely deleted when backup process is not running: tarBkp.elg, tarBkpErr.elg, temp_tar_exclude_*, and temp_tar_include_*.
A fix will be developed soon to automatically delete these files at the end of the backup execution.

Regarding ddrOutput* files, this will be fixed automatically for all online machines (including clean up of the files) by next week.

Both fixes will be included in the coming JHF’s

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Fri, 11 Dec 2020 14:23:21 GMT

Thank you Dov. Do you know when the fix will become available?

Thank you all (Heiko, Kaspars, Val, Dov) for the excellent support.

Kudos.

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Dov_Fraivert — Fri, 11 Dec 2020 14:35:54 GMT

In the coming JHF’s, I will update when they are released, which version interests you?

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Kris_Pellens — Fri, 11 Dec 2020 23:20:42 GMT

Hi Dov,

R80.20, R80.40, and R81.

Kind regards,

Kris

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

shubharora734 — Sat, 12 Dec 2020 08:44:51 GMT

Thank you for your feedback. Attached you'll find the output ls -lSr /tmp.

Re: Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

Holger_Lange — Wed, 13 Oct 2021 14:29:33 GMT

Is there any ETA for that fix or an issue ID for the Problem?
It seems the issue still persists today and I have to delete tarBkp.elg every few months