topic Re: Get full on "/logs" directory in SMB locally manage appliance in Spark Firewall (SMB)

Get full on "/logs" directory in SMB locally manage appliance

LeeBingKang — Thu, 24 Feb 2022 04:38:43 GMT

Recently, found out one of my client smb firewall's /logs directory was full.

As I observe on the mentioned directory, i found out several files in the directory and i can't confirm which can be deleted.

Hence, i appreciate if someone can help me on identifying which files are safe to be deleted.

Thank you.

Re: Get full on "/logs" directory in SMB locally manage appliance

HristoGrigorov — Thu, 24 Feb 2022 05:34:39 GMT

"core" file is the one that takes a lot of space and it is safe to be removed. This is a crash dump file and it is generally good idea to download it to a remote computer and open TAC case for CheckPoint to investigate it.

messages-*.gz are also safe to remove but those are very small in size and not much space will be freed.

Re: Get full on "/logs" directory in SMB locally manage appliance

LeeBingKang — Fri, 11 Mar 2022 06:27:48 GMT

Hi. Appreciate for your feedback on my question.

Re: Get full on "/logs" directory in SMB locally manage appliance

G_W_Albrecht — Thu, 24 Feb 2022 10:20:41 GMT

See here: sk139692: /logs fill up to 100% on Small and Medium Business Appliances

Re: Get full on "/logs" directory in SMB locally manage appliance

HristoGrigorov — Thu, 24 Feb 2022 10:27:50 GMT

This SK makes me laugh. Let's first dump core file and then tell the customer to just go and delete it. Absolute nonsense.

Re: Get full on "/logs" directory in SMB locally manage appliance

_Val_ — Thu, 24 Feb 2022 11:01:44 GMT

This is not what the SK says. It says, 100% utilization is explained by an existing core dump. Once core dump file deleted, it should be back to normal.

Also, I personally do not find your comment helping anyone here. Let's all be just a bit more professional, thanks.

Re: Get full on "/logs" directory in SMB locally manage appliance

HristoGrigorov — Thu, 24 Feb 2022 11:07:45 GMT

@_Val_ It is not professional to dump core and then ask the customer to just delete it without opening TAC case. Even more, silently dumping core files and not letting customer know about this is even more unprofessional. Hope it is a bit more clear now.

Re: Get full on "/logs" directory in SMB locally manage appliance

_Val_ — Thu, 24 Feb 2022 11:13:26 GMT

There is a feedback form in the SK, and you are welcome to use it.