Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Fred_Howard
Explorer

SmartLog only shows 3 days of logs.

I cannot query any logs older than 3 days.  df -h showed 99% in var/log, I have adjusted settings to delete files and got it to 83%, still no change.  

0 Kudos
10 Replies
Fred_Howard
Explorer

Edit: Running R77.30, Stand alone log server.

0 Kudos
Daniel_Taney
Advisor

Do you have SmartLog enabled? If so, did you also configure the log server to purge indexes as well as logs? 

Those index files will get very unruly if they aren't purged along with the logs!

R80 CCSA / CCSE
0 Kudos
Fred_Howard
Explorer

Yes, SmartLog is enabled and the Index is set to delete at 14 days.  We did the start/stop command as well.  Are these settings on the manager or logs server itself?

Thanks for the help!

0 Kudos
Daniel_Taney
Advisor

In your case, it should be set on the log server. In the bottom left of SmartLog, there should be a gauge that shows your disk usage. If you hover over it, you should get more detail. 

What do you see consuming the majority of your space? Log Indexes would be the actual index files for SmartLog. I've found that typically "Other" constitutes the traditional flat log files that SmartView Tracker uses. Checking this may at least give you a better handle of where your space is going. 

R80 CCSA / CCSE
0 Kudos
Daniel_Taney
Advisor

If you see Other consuming more space than you're expecting, I would make sure your cleanup script actually cleaned up the old files going back in time instead of just moving forward. 

You can check $FWDIR/log to see what's sitting around in there:

If there are lots of old flat file logs still sitting there, maybe try removing some and see if that helps improve your log index retention by relieving some disk space? Usually, I just use the rm command with some wildcard to do small blocks at a time.

R80 CCSA / CCSE
0 Kudos
Fred_Howard
Explorer

Thanks Daniel!  I appreciate your help.

0 Kudos
nurka_0522
Explorer

hi, i need to clear var/log data files on the disk log files used too much capacity. Pls help me. we have checkpoint storage is full

0 Kudos
_Val_
Admin
Admin

0 Kudos
Dror_Aharony
Employee Alumnus
Employee Alumnus

Please state your version.

only 58GB in /var/log/ (Logs partition) is very low.

What is your ~log-rate/sec? Do you use SmartLog/Log-Indexing?

Add more disk-space.

Assign it to /var/log/ specifically using sk94671 (assuming VM) & lvm_manager tool. see:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

 

 

 

 

0 Kudos
Daniel_Taney
Advisor

Sorry... also maybe try a smartlogstopsmartlogstart after disk space gets freed up?

R80 CCSA / CCSE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events