topic Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log in Firewall and Security Management

How to decrease a usage of /dev/mapper/vg_splat_lv-log

Egor_Cherkasov — Mon, 11 Mar 2019 13:31:27 GMT

Hello Checkmates,

there is the promlem and I cannot still understand what is the folder /dev/mapper/vg_splat_lv-log , which is mounted in /var/log/ resposible for?

There is a screenshot , where you can see that the /var/log/ folder is quickly filling.

During the last 7 days the usage has increased from 53% to 63%.

I guess that is a very rapid and anomaly behaviour.

Advise please how to solve this problem with quick filling.

Can I do something and solve this problem?

Thank you very much!

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Mon, 11 Mar 2019 14:03:39 GMT

Enlarge the partition. More see here:

Managing partition sizes via LVM manager on Gaia OS

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Fri, 21 Jun 2019 09:02:29 GMT

Or this very nice doku to add an disk:

https://community.checkpoint.com/message/32132-how-to-add-a-new-disk-and-expand-the-log-file-system

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Egor_Cherkasov — Mon, 11 Mar 2019 14:07:58 GMT

Thank you for a quick answer, but does that mean that all the files in that folder are necessary and we cannot remove some of them?

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Wolfgang — Mon, 11 Mar 2019 14:08:45 GMT

This directory holds all logs. Logs from your gateways and all logs of your managementserver. Regarding the amount of your logged traffic this is normal behaviour. Extending the partion Heiko mentioned is the best solution.

Wolfgang

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Vincent_Bacher — Mon, 11 Mar 2019 14:12:23 GMT

If the log is not filled up by normal logs, maybe a debug is running and forgotten to turn off?
So maybe some *.elg files permanently growing?
then
fw ctl debug 0
could help
Or if the files are vpnd.elg and ike.elg
vpn debug truncoff
could help

If it's just old log data, you ma delete the oldest if not needed.

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Egor_Cherkasov — Mon, 11 Mar 2019 14:13:03 GMT

Thank you gentlemen!

I am going to try this approach.

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Egor_Cherkasov — Mon, 11 Mar 2019 14:14:12 GMT

Do you mean to use RemoveOldVersion.tar script by Check Point?

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Vincent_Bacher — Mon, 11 Mar 2019 14:15:59 GMT

No, old logfiles. SMS is usually rotating logs renaming the old files using timestamp ath the beginning.

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Mon, 11 Mar 2019 14:18:28 GMT

Delete old log files from management server.

$FWDIR/log is a S-Link to this directory in /var/log/.

for R80.10: /var/log/opt/CPsuite-R80.10/fw1/log/

for R80.20: /var/log/opt/CPsuite-R80.20/fw1/log/

Here you can delete old logs from SmartLog after the date.

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Mon, 11 Mar 2019 14:21:39 GMT

For example for the 2019-01-20

# cd /var/log/opt/CPsuite-R80.10/fw1/log

# rm 2019-01-20*

You can also use "cd $FWDIR/log/"

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Vincent_Bacher — Mon, 11 Mar 2019 14:22:36 GMT

Just have a look at Heikos descriptions above

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Mon, 11 Mar 2019 14:23:31 GMT

Or all logs for January 2019

# cd /var/log/opt/CPsuite-R80.10/fw1/log/

# rm 2019-01*

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Egor_Cherkasov — Mon, 11 Mar 2019 14:25:52 GMT

Yes, I've understood your very useful information, once again thank you!

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

Vincent_Bacher — Mon, 11 Mar 2019 14:29:27 GMT

find $FWDIR/log -type f -name '201*' -mtime +30 -exec rm {} \;

for such files older than 30 days

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

HeikoAnkenbrand — Mon, 11 Mar 2019 14:38:35 GMT

https://community.checkpoint.com/people/8221a355-5448-47cb-9c8a-d5f330a5909c - Nice one liner!

Comes into my CLI one liner collection!

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

_Val_ — Mon, 11 Mar 2019 17:11:41 GMT

Just make sure you do not delete logs you have to keep 🙂

I would rather suggest archiving those, sending to an external location via ftp or sftp and then remove

Re: How to decrease a usage of /dev/mapper/vg_splat_lv-log

maja — Wed, 04 Jan 2023 15:47:29 GMT

Hello! Does it need to reboot the Sec Mgmt to take affect of the freed space? Have the same issue, deleted old logs, but no space is freed.

thank you,