topic Re: VAR/Log/Spool/Mail is getting filled continuously in General Topics

VAR/Log/Spool/Mail is getting filled continuously

entsupport — Thu, 24 Oct 2019 10:27:56 GMT

Hello All,

Recently I have upgraded the gateway from R77.30 to R80.10 version. We are observing the var/log is getting full very rapidly. We have logged a case with Checkpoint TAC & they have said that var/log/spool/mail is getting filled in 2 seconds of time. Almost 2 kb i getting consumed in every 2 sec. TAC has not yet able to identify the root cause of this issue.

Can anyone help to identify the root cause & resolve the issue? We are struggling almost a month for this issue. We have reinstalled the R80.10 three times & also changed the gateway but still the issue persists.

Need your support to get this issue resolved.

Regards,

Abhishek

Re: VAR/Log/Spool/Mail is getting filled continuously

PhoneBoy — Sat, 26 Oct 2019 23:46:40 GMT

Do you have IPS configured to capture packets when a signature is triggered?
That's what generally gets there in R80.x (they were in a different place in R77.x).
These files should exist on the gateway temporarily until the log server retrieves them.
However, in some cases, it seems these files aren't removed correctly.
Definitely need to work with the TAC on this.

Re: VAR/Log/Spool/Mail is getting filled continuously

entsupport — Tue, 05 Nov 2019 13:51:14 GMT

TAC Team is unable to identify the issue.

Re: VAR/Log/Spool/Mail is getting filled continuously

hrath — Fri, 18 Sep 2020 00:20:19 GMT

sk146872 - /var/log/spool/mail/ disk space utilization constantly increasing