Need to clear space on /opt

[Tony_Graham]

Logging into SmartConsole this AM and receive a message:

Partition /opt has 569MB of free space it's lower than the required 2000MB.

Any idea what I can clear off?

[simonemantovani]

You can follow, for example, this thread:

https://community.checkpoint.com/t5/Firewall-and-Security-Management/Disk-Space-issues-on-Gateway/m-...

[Lesley]

please share:

du -ah /opt | sort -n -r | head -n 100

find / -size +500M -type f -exec ls -lh {} \;

df -h

And also check if this sk is relevant for you: 

https://support.checkpoint.com/results/sk/sk183836

[Tony_Graham]

The biggest files are in /var/log but it looks like that is a different filesystem from /

Filesystem                      1K-blocks      Used Available Use% Mounted on
/dev/mapper/vg_splat-lv_current  35993216  32799232   1358976  97% /
/dev/sda1                          287369    159874    112235  59% /boot
tmpfs                             8006660     22776   7983884   1% /dev/shm
/dev/mapper/vg_splat-lv_log     708855000 133142912 539116788  20% /var/log
cgroup                            8006660         4   8006656   1% /sys/fs/cgroup

-rwx------ 1 admin root 1.1G Mar 17 12:20 /run/libpod/events/events.log
-rw-rw---- 1 admin root 1.2G Dec 13  2021 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#1#BUNDLE_R80_40_JUMBO_HF_MAIN#139/Check_Point_R
80_40_JUMBO_HF_Bundle_T139_sk165456_FULL.tgz
-rw-rw---- 1 admin root 3.7G Aug  7  2023 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#4#R81.20_ivory_main_T631/Check_Point_R81.20_T631_Fr
esh_Install_and_Upgrade.tgz
-rw-rw---- 1 admin root 1.9G Feb 16  2023 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#3#BUNDLE_R81_10_JUMBO_HF_MAIN#87/Check_Point_R8
1_10_JUMBO_HF_MAIN_Bundle_T87_FULL.tgz
-rw-rw---- 1 admin root 1.2G Mar 22  2022 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#58/Check_Point_R81_J
UMBO_HF_MAIN_Bundle_T58_FULL.tgz
-rw-rw---- 1 admin root 2.9G Mar  3  2025 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#98/Check_Point_R8
1_20_JUMBO_HF_MAIN_Bundle_T98_FULL.tgz
-rw-rw---- 1 admin root 3.7G Nov 11  2020 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#1#R80.40_T294/Check_Point_R80.40_T294_Fresh_Install
_and_Upgrade.tgz
-rw-rw---- 1 admin root 5.5G Jan  6  2022 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#2#BLINK_R81_T392_JHF_T44_MGMT/Blink_image_1.1_Check
_Point_R81_T392_JHF_T44_SecurityManagement.tgz
-rw-rw---- 1 admin root 736M Feb 27  2020 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN_gogoKernel#118/Ch
eck_Point_R80_20_JUMBO_HF_Bundle_T118_sk137592_Security_Management_3_10_FULL.tgz
-rw-rw---- 1 admin root 600M Oct 10  2019 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN_gogoKernel#103/Ch
eck_Point_R80_20_JUMBO_HF_Bundle_T103_sk137592_Security_Management_3_10_FULL.tgz
-rw-rw---- 1 admin root 2.0G Jan 12 12:08 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#5#BUNDLE_R82_JUMBO_HF_MAIN#44/Check_Point_R82_j
umbo_hf_main_Bundle_T44_FULL.tgz
-rw-rw---- 1 admin root 763M Jul 17  2019 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#203/Check_Point_R80_10
_JUMBO_HF_Bundle_T203_sk116380_FULL.tgz
-rw-rw---- 1 admin root 1.3G Aug 25  2022 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#69/Check_Point_R81_J
UMBO_HF_MAIN_Bundle_T69_FULL.tgz
-rw-rw---- 1 admin root 2.4G Jun 24  2024 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#65/Check_Point_R8
1_20_JUMBO_HF_MAIN_Bundle_T65_FULL.tgz
-rw-rw---- 1 admin root 826M May 27  2021 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#1#BUNDLE_R80_40_JUMBO_HF_MAIN#118/Check_Point_R
80_40_JUMBO_HF_Bundle_T118_sk165456_FULL.tgz
-rw-rw---- 1 admin root 3.4G Jun 22  2021 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#2#R81_T392/Check_Point_R81_T392_Fresh_Install_and_U
pgrade_v1.tgz
-rw-rw---- 1 admin root 11G Aug  4  2025 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#5#BLINK_R82_T777_JHF_T34_MGMT/Blink_image_1.1_Check_
Point_R82_T777_JHF_T34_SecurityManagement.tgz
-rw-rw---- 1 admin root 708M Mar  6  2019 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#189/Check_Point_R80_10
_JUMBO_HF_Bundle_T189_sk116380_FULL.tgz
-rw-rw---- 1 admin root 2.0G Mar  3 11:23 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#5#BUNDLE_R82_JUMBO_HF_MAIN#60/Check_Point_R82_j
umbo_hf_main_Bundle_T60_FULL.tgz
-rw-rw---- 1 admin root 1.9G Aug  7  2023 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#3#BUNDLE_R81_10_JUMBO_HF_MAIN#109/Check_Point_R
81_10_JUMBO_HF_MAIN_Bundle_T109_FULL.tgz
-rw-rw---- 1 admin root 3.4G Feb 25  2022 /var/log/CPda/repository/CheckPoint#Major#All#6.0#5#3#R81.10_ignis_main_T335/Check_Point_R81.10_T335_Fr
esh_Install_and_Upgrade.tgz
-rw------- 1 admin root 1.6G Mar 17 12:20 /var/lib/containers/storage/overlay-containers/c4e9e7e6544fad7380fecdd50e30d2ab8693cfd47b7e3cd8df19905f
45621406/userdata/ctr.log
-rw------- 1 admin root 709M Nov 17 14:15 /opt/CPDiffReportServer/lib/business_logic/mgmtcomp-diff-report-client.tar
-rw------- 1 cp_postgres root 942M Mar 16 14:07 /opt/CPshrd-R82/database/postgresql/data/base/116268/2613
-rw-rw---- 1 admin root 1.7G Apr 27  2025 /opt/CPInstLog/aiops-on-board.log

[Tony_Graham]

du -h --max-depth=1 /var/log/opt | sort -n -r
1009M   /var/log/opt/CPrt-R80
967M    /var/log/opt/CPrt-R80.20
375M    /var/log/opt/CPshrd-R81.10
367M    /var/log/opt/CPshrd-R80.40
276M    /var/log/opt/CPshrd-R81
67M     /var/log/opt/CPshrd-R80.20
65M     /var/log/opt/CPshrd-R80
62G     /var/log/opt
41M     /var/log/opt/CPSmartLog-R80
32K     /var/log/opt/CPotlpAgent
23G     /var/log/opt/CPsuite-R82
22M     /var/log/opt/CPSmartLog-R81
19M     /var/log/opt/CPSmartLog-R80.40
16G     /var/log/opt/CPsuite-R81.20
8.0K    /var/log/opt/CPviewExporter
6.5M    /var/log/opt/CPSmartLog-R80.20
4.0M    /var/log/opt/CPSmartLog-R81.20
4.0K    /var/log/opt/CPcvpn-R81.20
4.0K    /var/log/opt/CPcvpn-R80.40
4.0K    /var/log/opt/CPcvpn-R80.20
3.9M    /var/log/opt/CPSmartLog-R81.10
2.8G    /var/log/opt/CPrt-R82
2.7G    /var/log/opt/CPsuite-R81.10
2.3G    /var/log/opt/CPrt-R81.20
2.0M    /var/log/opt/CPSmartLog-R82
1.7G    /var/log/opt/CPsuite-R80.20
1.7G    /var/log/opt/CPrt-R81
1.6G    /var/log/opt/CPshrd-R82
1.5G    /var/log/opt/CPsuite-R80.40
1.4G    /var/log/opt/CPsuite-R81
1.4G    /var/log/opt/CPshrd-R81.20
1.3G    /var/log/opt/CPsuite-R80
1.2G    /var/log/opt/CPrt-R81.10
1.1G    /var/log/opt/CPrt-R80.40

[Tony_Graham]

du -ah /opt | sort -n -r | head -n 100
1020K   /opt/CPsuite-R82/fw1/cpm-server/commons-compress-1.22.jar
1020K   /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/static/sec_checkup/mtp_about.svg
1020K   /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/VAADIN/themes/renoir/sec_checkup/mtp_about.svg
1020K   /opt/CPRepMan-R82/lib/dependency/commons-compress-1.22.jar
1016K   /opt/CPUserCheckPortal/htdocs/UserCheck/img
1016K   /opt/CPSamlPortal/phpincs/simplesamlphp/src/SimpleSAML
1012K   /opt/CPuepm-R82/system/3rd_party/new_jars/shared_lib/spring-webmvc-5.3.31.jar
1012K   /opt/CPuepm-R82/system/3rd_party/new_jars/eps_shp_lib/war/spring-webmvc-5.3.31.jar
1012K   /opt/CPuepm-R82/engine/shared/lib/spring-webmvc-5.3.31.jar
1012K   /opt/CPuepm-R82/engine/conf/updates/tmp/sdk/libopenssl_verifier.so
1012K   /opt/CPshrd-R82/database/postgresql/util/symmetric-ds/web/WEB-INF/lib/spring-webmvc-5.3.27.jar
1012K   /opt/CPshrd-R82/database/postgresql/data/base/116268/122685
1008K   /opt/CPzetc/lib/libpacparser.so.1
1008K   /opt/CPzetc/lib/libpacparser.so
1008K   /opt/CPsuite-R82/fw1/c-icap
1008K   /opt/CPshrd-R82/jre_64/lib/ibmjgssprovider.jar
1008K   /opt/CPshrd-R82/jre_32/lib/ibmjgssprovider.jar
1008K   /opt/CPrt-R82/tmp/jetty-127.0.0.1-8084-smartview-service.war-_smartview-any-/webapp/WEB-INF/lib/commons-compress-1.21.jar
1008K   /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/WEB-INF/lib/commons-compress-1.21.jar
1008K   /opt/CPInstLog/install_uepm_HOTFIX_R81_20_JUMBO_HF_MAIN_5.log
1004K   /opt/CPshrd-R82/EasyDebug/dbg_scripts/dbg_scripts/Connectivity
1004K   /opt/CPshrd-R82/EasyDebug/dbg_scripts/Connectivity
1004K   /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/VAADIN/themes/default/styles.css
1004K   /opt/CPSFWR80CMP-R82/lib
1000K   /opt/CPuepm-R82/system/3rd_party/new_jars/shared_lib/jaxb-runtime-2.3.9.jar
1000K   /opt/CPuepm-R82/engine/shared/lib/jaxb-runtime-2.3.9.jar
1000K   /opt/CPrt-R82/jars/commons-compress-1.21.jar
996K    /opt/CPsuite-R82/fw1/oracle_oi/cleancontent/jre/lib/J9TraceFormat.dat
992K    /opt/CPshrd-R82/database/postgresql/lib/libpq64
992K    /opt/CPSamlPortal/phpincs/simplesamlphp/modules/core
988K    /opt/CPsuite-R82/fw1/Python/lib/python3.11/site-packages/redis/commands
984K    /opt/CPsuite-R82/fw1/cpm-server/opensaml-saml-impl-3.1.1.jar
980K    /opt/CPuepm-R82/tomcat_ex/lib/tomcat-coyote-9.0.98.jar
980K    /opt/CPuepm-R82/engine/lib/tomcat-coyote-9.0.98.jar
980K    /opt/CPuepm-R82/engine/conf/updates/tmp/sdk/liblicensing_meta.so
980K    /opt/CPsuite-R82/fw1/lib64/libOS.so
980K    /opt/CPshrd-R82/lib64/libOS.so
976K    /opt/CPuepm-R82/engine/scripts/reconnect_tool_on_premise/EPS_Reconnect_Tool_OnPremise_mac.zip
976K    /opt/CPInstLog/install_fw1_HOTFIX_R80_20_JUMBO_HF_MAIN_1.log
972K    /opt/CPsuite-R82/fw1/oracle_oi/cleancontent/jre/lib/ibmjgssprovider.jar
972K    /opt/CPsuite-R82/fw1/cpm-server/target_extract_pkg/sd_updates_vpn1_dir/tags_list.xml
968K    /opt/CPuepm-R82/engine/webapps/EPS/WEB-INF/lib/eps_dal_emon.jar
968K    /opt/CPrt-R82/lib/libredDetector.so
964K    /opt/aspam_engine/ctasd/bin/ctasd.bin
964K    /opt/aspam_engine/amw/ctasd/bin/ctasd.bin
964K    /opt/CPshrd-R82/database/postgresql/data/base/116268/134931
964K    /opt/CPR77CMP-R82/lib
960K    /opt/aspam_engine/ctasd/lib/oslib
960K    /opt/aspam_engine/amw/ctasd/lib/oslib
960K    /opt/CPInstLog/install_uepm_HOTFIX_R81_20_JUMBO_HF_MAIN_3.log
956K    /opt/CPsuite-R82/fw1/Solr7/solr-webapp/webapp/WEB-INF/lib/caffeine-2.4.0.jar
956K    /opt/CPshrd-R82/database/postgresql/data/base/116268/118527
956K    /opt/CPrt-R82/jars/caffeine-2.4.0.jar
952K    /opt/CPsuite-R82/fw1/cpm-server/object_store.jar
948K    /opt/CPsuite-R82/fw1/cpm-server/web_api_is.jar
948K    /opt/CPsuite-R82/fw1/Python64/lib/python3.11/http
948K    /opt/CPsuite-R82/fw1/Python/lib/python3.11/http
948K    /opt/CPshrd-R82/database/postgresql/data/base/77565/77746
944K    /opt/GaiaTools/gshell/dist/gshell
943M    /opt/CPshrd-R82/database/postgresql/data/base/116268/2613
940K    /opt/CPsuite-R82/fw1/lib/libCPMIClient.so
940K    /opt/CPrt-R82/tmp/jetty-127.0.0.1-8084-smartview-service.war-_smartview-any-/webapp/config
940K    /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/config
936K    /opt/CPsuite-R82/fw1/oracle_oi/fonts/calibriz.ttf
936K    /opt/CPsuite-R82/fw1/lib/libfw_verify.so
936K    /opt/CPsuite-R82/fw1/Solr7/solr-webapp/webapp/libs/angular.js
932K    /opt/CPuepm-R82/bin/7zip_tool/7zr
932K    /opt/CPshrd-R82/lib/libboost_regex.so.1.64.0
932K    /opt/CPSFWR77CMP-R82/lib
932K    /opt/CPDynamicContent/tmp
928K    /opt/CPsuite-R82/fw1/lib/libUCAPILib.so
928K    /opt/CPsuite-R82/fw1/Python/lib/python3.11/site-packages/rich/__pycache__
928K    /opt/CPR76CMP-R82/lib
928K    /opt/CPDynamicContent/tmp/000001762709232
928K    /opt/CPDynamicContent/revisions/simplified_tp_dc/000001762709239
928K    /opt/CPDynamicContent/revisions/simplified_tp_dc/000001754344416
924K    /opt/CPsuite-R82/fw1/lib/libCPInstMgrIpsConvComps.so
924K    /opt/CPshrd-R82/jre_64/lib/ext/dtfj.jar
924K    /opt/CPshrd-R82/jre_64/lib/amd64/default/libj9vrb29.so
924K    /opt/CPshrd-R82/jre_64/lib/amd64/compressedrefs/libj9vrb29.so
924K    /opt/CPshrd-R82/jre_32/lib/ext/dtfj.jar
924K    /opt/CPshrd-R82/database/postgresql/data/base/116268/116282
924K    /opt/CPDynamicContent/tmp/000001762709232/simplified_tp_dc
924K    /opt/CPDynamicContent/revisions/simplified_tp_dc/000001762709239/simplified_tp_dc
924K    /opt/CPDynamicContent/revisions/simplified_tp_dc/000001754344416/simplified_tp_dc
920K    /opt/CPsuite-R82/fw1/cpm-server/ips_classes.jar
916K    /opt/CPuepm-R82/engine/webapps/CP
916K    /opt/CPsuite-R82/fw1/oracle_oi/cleancontent/jre/lib/plugin.jar
916K    /opt/CPsuite-R82/fw1/oracle_oi/cleancontent/jre/lib/ext/dtfj.jar
916K    /opt/CPsuite-R82/fw1/lib/libOS.so
916K    /opt/CPshrd-R82/lib/libOS.so
916K    /opt/CPshrd-R82/jre_64/lib/plugin.jar
916K    /opt/CPshrd-R82/jre_32/lib/plugin.jar
916K    /opt/CPshrd-R82/database/postgresql/bin/ecpg
916K    /opt/CPrt-R82/tmp/log_indexer_proxy-webapp/webapp/WEB-INF/lib/jaxb-impl-2.2.7.jar
916K    /opt/CPrt-R82/tmp/jetty-127.0.0.1-8084-smartview-service.war-_smartview-any-/webapp/WEB-INF/lib/jaxb-impl-2.2.7.jar
916K    /opt/CPrt-R82/tmp/jetty-127.0.0.1-8082-smartview.war-_smartview-any-/webapp/WEB-INF/lib/jaxb-impl-2.2.7.jar
916K    /opt/CPSamlPortal/phpincs/simplesamlphp/vendor/symfony/http-kernel
912K    /opt/CPuepm-R82/engine/webapps/CP/WEB-INF
908K    /opt/aspam_engine/ctasd/lib/oslib/libstdc++.so.6

[the_rock]

You can try something like below from expert mode:

find /opt -size +500M

It would search for any files bigger than 500Mbs (size can be changed to anything really). Just make sure NOT to delete any database files by mistake. Please do take a backup beforehand, just in case.

[Tony_Graham]

I removed a previous Take directory from /opt/CPda/backup but it did not seem to have any effect. It shows 1.3G available in / via CLI but still reports 569M at console launch. I need to clear off more though it is still 97% full.

[the_rock]

If you are allowed to do remote, be free to send me the link via DM and we can check together.

[Lesley]

Looks like you have an older installation. Sometimes the files just pile up from previous takes. Just check out all those old takes, blink images etc. If there is really nothing to clear up, what sometimes happens, you can either extend the /opt direct with lvm_manager as stated in: https://support.checkpoint.com/results/sk/sk121198

Or do a fresh install (last option)

[Tony_Graham]

What do you think about deleting files under /opt/CPInstLog? There are a lot of large ones in there.

Specifically, iot-on-board.log.

[the_rock]

Im fairly positive its fine (I did it before0, but PLEASE, do generate at least backup before anything, because if **** hits the fan, backup will be your saving grace. better be safe than sorry.

[Tony_Graham]

Well I looked into iot-on-board.log and it is full of failure messages, see below. Started having problems with TE with upcoming renewal (happens annually btw), I cat'd /dev/null to it and that got me another 2% disk space. I have a current backup so no worries. Message now states I have 1321MB free so getting there.

2026-03-17 12:44:20,467  INFO  No cloud connectivity
2026-03-17 12:47:20,467  DEBUG  Checking cloud connectivity
2026-03-17 12:47:20,467  DEBUG  Running mgmt_cli command 'show cloud services' (['show-cloud-services'])
2026-03-17 12:47:21,296  INFO  No cloud connectivity
2026-03-17 12:50:21,296  DEBUG  Checking cloud connectivity
2026-03-17 12:50:21,296  DEBUG  Running mgmt_cli command 'show cloud services' (['show-cloud-services'])
2026-03-17 12:50:21,774  INFO  No cloud connectivity
2026-03-17 12:53:21,774  DEBUG  Checking cloud connectivity
2026-03-17 12:53:21,774  DEBUG  Running mgmt_cli command 'show cloud services' (['show-cloud-services'])
2026-03-17 12:53:22,326  INFO  No cloud connectivity

[the_rock]

Im fairly positive those are good to remove (I did it before myself and no issues).

[Tony_Graham · Accepted solution]

Well I think I found the culprit. File called aiops-on-board.log.

17G in size.

[the_rock]

There you go.

[Tony_Graham]

I cat'd /dev/null to it. Disk space is at 87% now. Back in my Unix days, we used to cat /dev/null in case some process had a lock on the log file. It won't wig out like if were to just delete it.

[the_rock]

Its a bit different on Gaia, though its Linux based.