topic Re: Log Partition filled up in General Topics

Log Partition filled up

chandan_urs — Fri, 14 Apr 2023 12:47:35 GMT

Log partition getting filled up on gateway.

Setup: Distributed setup with single gateway
OS : R81.10 HF94

> On Mgmt we could see the daily logs and even in smart console logs are visible.
> Every day space utilization is getting increased on gateway even though traffic logs are getting properly forwarded to MGMT server.
> currently we have disabled the packet capture in the threat prevention profile, but still we partition is getting filled up.

relevent commands collected during the troubleshooting.

# enabled_blades
fw urlf av appi ips anti_bot content_awareness mon

# on 12th we have cleared older files in repository and also backups and log files, and var/log partition was only 59% but after 24hrs its already 75%

> ANy inputs and troubleshooting methods are helpul.

Regards

Chandan

Re: Log Partition filled up

PhoneBoy — Sat, 15 Apr 2023 00:12:45 GMT

You should probably follow this SK to see what files are big: https://support.checkpoint.com/results/sk/sk63361
And, as the SK suggests, you should probably work with the TAC: https://help.checkpoint.com

Re: Log Partition filled up

Maarten_Sjouw — Mon, 17 Apr 2023 04:57:16 GMT

A long time ago I ran into a simple program called treesize which allows you to run it in any directory and will give you a listing of the directories with the amount of KB/MB/GB is used in that directory.

run : vi /usr/bin/treesize

and paste this content:

du -k --max-depth=1 | sort -nr | awk '
BEGIN {
split("KB,MB,GB,TB", Units, ",");
}
{
u = 1;
while ($1 >= 1024) {
$1 = $1 / 1024;
u += 1
}
$1 = sprintf("%.1f %s", $1, Units[u]);
print $0;
}
'

Close vi and execute: chmod +x /usr/bin/treesize