Log Partition filled up

[chandan_urs]

Log partition getting filled up on gateway.

Setup: Distributed setup with single gateway
OS : R81.10 HF94

> On Mgmt we could see the daily logs and even in smart console logs are visible.
> Every day space utilization is getting increased on gateway even though traffic logs are getting properly forwarded to MGMT server.
> currently we have disabled the packet capture in the threat prevention profile, but still we partition is getting filled up.

relevent commands collected during the troubleshooting.

# enabled_blades
fw urlf av appi ips anti_bot content_awareness mon

# on 12th we have cleared older files in repository and also backups and log files, and var/log partition was only 59% but after 24hrs its already 75%

> ANy inputs and troubleshooting methods are helpul.

Regards

Chandan

[PhoneBoy]

You should probably follow this SK to see what files are big: https://support.checkpoint.com/results/sk/sk63361 
And, as the SK suggests, you should probably work with the TAC: https://help.checkpoint.com 

[Maarten_Sjouw · Accepted solution]

A long time ago I ran into a simple program called treesize which allows you to run it in any directory and will give you a listing of the directories with the amount of KB/MB/GB is used in that directory.

run : vi  /usr/bin/treesize 

and paste this content:

du -k --max-depth=1 | sort -nr | awk '
       BEGIN {
              split("KB,MB,GB,TB", Units, ",");
       }
       {
            u = 1;
            while ($1 >= 1024) {
                     $1 = $1 / 1024;
                     u += 1
            }
           $1 = sprintf("%.1f %s", $1, Units[u]);
           print $0;
     }
    '

Close vi and execute: chmod +x /usr/bin/treesize