Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Explorer

SmartLog only shows 3 days of logs.

I cannot query any logs older than 3 days.  df -h showed 99% in var/log, I have adjusted settings to delete files and got it to 83%, still no change.  

Tags (1)
0 Kudos
Reply
10 Replies
Highlighted
Explorer

Edit: Running R77.30, Stand alone log server.

0 Kudos
Reply
Highlighted
Advisor

Do you have SmartLog enabled? If so, did you also configure the log server to purge indexes as well as logs? 

Those index files will get very unruly if they aren't purged along with the logs!

R80 CCSA / CCSE
0 Kudos
Reply
Highlighted
Explorer

Yes, SmartLog is enabled and the Index is set to delete at 14 days.  We did the start/stop command as well.  Are these settings on the manager or logs server itself?

Thanks for the help!

0 Kudos
Reply
Highlighted
Advisor

In your case, it should be set on the log server. In the bottom left of SmartLog, there should be a gauge that shows your disk usage. If you hover over it, you should get more detail. 

What do you see consuming the majority of your space? Log Indexes would be the actual index files for SmartLog. I've found that typically "Other" constitutes the traditional flat log files that SmartView Tracker uses. Checking this may at least give you a better handle of where your space is going. 

R80 CCSA / CCSE
0 Kudos
Reply
Highlighted
Advisor

If you see Other consuming more space than you're expecting, I would make sure your cleanup script actually cleaned up the old files going back in time instead of just moving forward. 

You can check $FWDIR/log to see what's sitting around in there:

If there are lots of old flat file logs still sitting there, maybe try removing some and see if that helps improve your log index retention by relieving some disk space? Usually, I just use the rm command with some wildcard to do small blocks at a time.

R80 CCSA / CCSE
0 Kudos
Reply
Highlighted
Explorer

Thanks Daniel!  I appreciate your help.

0 Kudos
Reply
Highlighted
Explorer

hi, i need to clear var/log data files on the disk log files used too much capacity. Pls help me. we have checkpoint storage is full

0 Kudos
Reply
Highlighted
Admin
Admin

0 Kudos
Reply
Highlighted
Employee++
Employee++

Please state your version.

only 58GB in /var/log/ (Logs partition) is very low.

What is your ~log-rate/sec? Do you use SmartLog/Log-Indexing?

Add more disk-space.

Assign it to /var/log/ specifically using sk94671 (assuming VM) & lvm_manager tool. see:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

 

 

 

 

0 Kudos
Reply
Highlighted
Advisor

Sorry... also maybe try a smartlogstopsmartlogstart after disk space gets freed up?

R80 CCSA / CCSE
0 Kudos
Reply