topic Re: SMB overview in Spark Firewall (SMB)

SMB overview

Bistro — Wed, 19 Apr 2023 07:49:53 GMT

I am relatively new to checkpoint and need to work on some 1400 and 1570 SMBs, to get a better understanding of the storage format could someone advise me on:

What are the different storage partitions on the SMBs - list them all out and with their capacity
What files go to each of them
What are the best practice recommendations for each of them
Is there a utility job that could be used to clean them up automatically

Re: SMB overview

_Val_ — Wed, 19 Apr 2023 08:01:04 GMT

Normally, you should not tamper with the file system. What is the nature of your request?

Re: SMB overview

Bistro — Wed, 19 Apr 2023 08:08:13 GMT

Mainly due to us installing a new SD card to free up storage as most of the disk spaces are filling up

Re: SMB overview

Chris_Atkinson — Wed, 19 Apr 2023 10:11:19 GMT

SD card expansion is only for security logs in most cases (per sk111586).

Re: SMB overview

_Val_ — Wed, 19 Apr 2023 10:49:33 GMT

To use SD cards with Quantum Spark appliances, please review sk111586 & sk144253.

let me know if you need any further assistance.

Re: SMB overview

G_W_Albrecht — Wed, 19 Apr 2023 13:39:31 GMT

This topic has been discussed already here: What information is stored in /storage partition

Val of course is right when asking for the reason you need details of the storage format, but here some additions:

- there usually is no need to care for any partitions for room left, as logs are rotated automatically.

- using an SD card for logging is suggested for locally managed USBs as the size of logs then will no longer be important and a reboot would not delete all old log files.

- best practice could be a reboot every 2 - 4 weeks that will also clear temporary files as well as all logs stored internally (that are not on a SD card).

Re: SMB overview

Bistro — Wed, 19 Apr 2023 14:31:57 GMT

Thanks for the reply, it's a centrally managed SMB so might differ could you elaborate on how logs are rotated automatically also what is the standard for how long logs should be kept on the device before they get deleted?

Re: SMB overview

G_W_Albrecht — Wed, 19 Apr 2023 14:40:29 GMT

If the SMB is centrally managed and the SMS or another CP Log Server is used for logging, an SD card is not needed. Logs will be stored on central log server and log rotation or delete on reboot will not apply ! In that case, the only files to remove from SMBs are core dumps if present (check through #ls -l /logs in expert Mode) 😉