topic Re: Unable to install Policy on Check Point Cluster in General Topics

Unable to install Policy on Check Point Cluster

Di_Junior — Mon, 13 Apr 2020 12:25:26 GMT

Dear Mates

I am unable to install policy on our cluster, the error is: Installation Failed. Reason: Load on Module failed - not enough disc space.

When I run the command df-h on the security gateway is question, I can see that the /dev/mapper/vg_splat-lv_current is 100% FULL.

I do not wish to increase the volume size, hence, I would like to know which files are safe to be deleted in order to free up some space in this partition.

Thanks in advance

Re: Unable to install Policy on Check Point Cluster

Mike_A — Mon, 13 Apr 2020 14:59:02 GMT

Run 'du -h /dev/mapper/vg_splat-lv_current | sort -h -r | head -n 10' to see the top 10 heavy hitters in the partition and whats eating up the space.

This doesn't answer your "what" to delete but it will indicate to you/TAC the files consuming disk space.

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Mon, 13 Apr 2020 19:44:38 GMT

Hi Mike

Thanks for your reply.

Just another quick question, in a cluster environment, is it mandatory for both members to have the same volume sizes?
Thanks in advance

Re: Unable to install Policy on Check Point Cluster

PhoneBoy — Mon, 13 Apr 2020 20:32:10 GMT

Generally, both cluster members should have the same hardware, which would include disk sizes and partitions.
I suppose disk might be ok if it's different, but you may be asking for trouble down the road.

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Mon, 13 Apr 2020 20:38:08 GMT

Thanks PhoneBoy

I think I will increase both to the same higher Volume size. But one thing strange is that the active cluster member had 100% while the standby has 56% used. Since this is preventing me from pushing policy, I think increasing the size is the only option I have for now, as I still need to figured out which files could be deleted from that volume.
My company should be paying our support contract soon, I guess until then the only option is to increase the volume size as I cannot consult TAC for now about the files that could be deleted.

Re: Unable to install Policy on Check Point Cluster

PhoneBoy — Mon, 13 Apr 2020 21:31:51 GMT

If you can post the output of: du -ah / | sort -h -r | head -n 20
We can make suggestions about what to remove.
If you see /var/log/CPda has a lot of stuff in it, these packages should be removed from the Gaia WebUI.

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Tue, 14 Apr 2020 09:10:23 GMT

Hi PhoneBoy

[Expert@CXXXXXXXX:0]# du -ah /|sort -r | head -n 20
99M /var/opt/CPsuite-R80.20/fw1/state
99M /var/log/files_repository/Raw_Files/D100C612-9D05-48AA-9F2A-F8C42528F100/581476/te_file_analyzer/aspose_jars/lib
99M /var/log/files_repository/Raw_Files/D100C612-9D05-48AA-9F2A-F8C42528F100/581476/te_file_analyzer/aspose_jars
99M /opt/CPsuite-R80.20/fw1/te_file_analyzer/aspose_jars/lib
99M /opt/CPsuite-R80.20/fw1/te_file_analyzer/aspose_jars
996K /var/opt/CPsuite-R80.20/fw1/dlp/config/dictionaries
996K /opt/CPcvpn-R80.20/var/ssl/ca-bundle
996K /opt/CPcvpn-R80.20/template/var/ssl/ca-bundle
996K /lib/libsplat_backup_is.so
992K /var/log/files_repository/Archive_Tool/8785455D-CDCA-49C6-B22F-D9325B260629/581125/wine/lib/wine/wininet.dll.so
992K /var/log/files_repository/Archive_Tool/8785455D-CDCA-49C6-B22F-D9325B260629/581125/wine/lib/wine/setupapi.dll.so
992K /opt/CPsuite-R80.20/fw1/cpm-server/parsers_settings.jar
98M /opt/CPsuite-R80.20/fw1/oracle_oi/fonts
988K /var/log/CPda/metadata/CheckPoint#CPUpdates#All#6.0#4#0#BUNDLE_R77_30_JUMBO_HF#317
988K /lib/libdb-4.3.so
984K /var/log/files_repository/Archive_Tool/8785455D-CDCA-49C6-B22F-D9325B260629/581125/wine/lib/wine/qcap.dll.so
984K /opt/CPsuite-R80.20/fw1/bin/ncode_export
980K /var/log/files_repository/Archive_Tool/8785455D-CDCA-49C6-B22F-D9325B260629/581125/wine/lib/wine/msctfp.dll.so
980K /var/log/files_repository/Archive_Tool/8785455D-CDCA-49C6-B22F-D9325B260629/581125/wine/lib/wine/fakedlls/mshtml.tlb
980K /opt/CPsuite-R80.20/fw1/cpm-server/connectra_classes.jar
[Expert@CP08LADCTFILDA:0]#

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Tue, 14 Apr 2020 09:16:35 GMT

Hi Phoneboy

the -s flag in the sort command was not working. So I run the command without it.

I attach the output.

Thanks

Re: Unable to install Policy on Check Point Cluster

PhoneBoy — Tue, 14 Apr 2020 18:20:27 GMT

I did not put a -s in my sort command, it was a -h.
Without that flag, the output you provided is not useful.

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Tue, 14 Apr 2020 19:06:51 GMT

Hi Phoneboy

My bad, I meant -h. bellow is the error I am getting.

[Expert@CPXXXXX]# du -ah /|sort -h -r | head -n 20
sort: invalid option -- h
Try `sort --help' for more information.

Re: Unable to install Policy on Check Point Cluster

PhoneBoy — Tue, 14 Apr 2020 19:19:16 GMT

Hm, I guess userspace of older systems might not have that option.
Try: du -akx / | sort -nr | head -20

Re: Unable to install Policy on Check Point Cluster

Di_Junior — Tue, 14 Apr 2020 19:30:42 GMT

[Expert@CPXXXXX]# clear
[Expert@CP08XXXXX]# du -akx / | sort -nr | head -20
20367009 /
10749276 /tmp_ips_stat_dir
10749244 /tmp_ips_stat_dir/ips.dbg
5047412 /opt
2024176 /opt/CPsuite-R80.20
2021512 /opt/CPsuite-R80.20/fw1
1968496 /var
1945344 /var/opt
1838540 /sysimg
1838532 /sysimg/CPwrapper
1838192 /sysimg/CPwrapper/linux
1726292 /var/opt/CPsuite-R80.20
1726288 /var/opt/CPsuite-R80.20/fw1
1265840 /opt/CPda
1180524 /opt/CPda/backup
968840 /var/opt/CPsuite-R80.20/fw1/conf
805220 /opt/CPda/backup/CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN#103
751224 /opt/CPshrd-R80.20
585020 /opt/CPsuite-R80.20/fw1/oracle_oi
419280 /sysimg/CPwrapper/linux/windows

Re: Unable to install Policy on Check Point Cluster

PhoneBoy — Tue, 14 Apr 2020 19:44:07 GMT

The most obvious thing: /tmp_ips_stat_dir
This is not one of the default directories and would certainly explain where all your space went.
If you're generating debug output, the last place you want to leave it is the root filesystem.

If you need this debug file for some reason, copy it to a different system.
It's not needed for system operation, though.