NTFS mount for /var/log

[Michael_Surtees]

Hi all,

First timer here, we have an R80.10 mgmt server running on a VM, for about a year now. With the new logging features of of R80.x we find that space gets chewed up pretty quick: there appears to be a couple of log repositories and indexes. On top of this there is the inbuilt workflow creating backups. 

So my question is whether it is safe to just move /var/log to an NTFS mount? 

Will this cause any unexpected issues? Is there a more precise way of dealing with it, i.e. getting files older than 14-days (for e.g.) onto the NTFS mount while keeping the latest local? 

The mgmt server is used a lot.

I'll be opening a low priority support case about this but any help from someone who has faced a similar issue would be greatly appreciated. I'll update with anything useful coming out of that case.

Many thanks in advance,

Michael   

[G_W_Albrecht]

There is a possibility to enlarge the VMs disk space, look here:

How to add a new disk and expand the log file system 

https://community.checkpoint.com/message/21228-increasing-disk-size-for-sms-on-esxi-vm-did-not-work?... 

[PhoneBoy]

While it may be possible to configure this, it’s definitely not recommended/supported.

Note that unless you are using R80.20 with the Linux 3.10 kernel, only SMBv1 will even work.

[Michael_Surtees]

Apologies - I did mean NFS mount. Your answer is no doubt correct for NTFS, and I'm delighted to have PhoneBoy respond to my first ever question. I'm also embarrassed by getting my question so wrong as to mean something else! 

Under R77.x mgmt we did utilize an NFS mount for long term storage. When the mgmt server was built, initially in parallel, it appears the NFS mount was not included in the build. 

We can expand the VM disk space - thanks to Gunther W. Albrecht for the links - but not by that much. We don't really have a long-term rentention issue as there is a SIEM we rely on for that. But we do frequently get disk space warnings on /var/log and it would be nice to have a supported solution without admin overhead. 

[PhoneBoy]

NTFS != NFS though they do much the same thing. 

Apparently, we do support NFSv2 and v3 (not v4): Gaia fails to perform NFS mounts 

It's definitely not something we encourage, though.