SmartLog only shows 3 days of logs.

[Fred_Howard]

I cannot query any logs older than 3 days.  df -h showed 99% in var/log, I have adjusted settings to delete files and got it to 83%, still no change.  

[Fred_Howard]

Edit: Running R77.30, Stand alone log server.

[Daniel_Taney]

Do you have SmartLog enabled? If so, did you also configure the log server to purge indexes as well as logs? 

Those index files will get very unruly if they aren't purged along with the logs!

[Fred_Howard]

Yes, SmartLog is enabled and the Index is set to delete at 14 days.  We did the start/stop command as well.  Are these settings on the manager or logs server itself?

Thanks for the help!

[Daniel_Taney]

In your case, it should be set on the log server. In the bottom left of SmartLog, there should be a gauge that shows your disk usage. If you hover over it, you should get more detail. 

What do you see consuming the majority of your space? Log Indexes would be the actual index files for SmartLog. I've found that typically "Other" constitutes the traditional flat log files that SmartView Tracker uses. Checking this may at least give you a better handle of where your space is going. 

[Daniel_Taney]

If you see Other consuming more space than you're expecting, I would make sure your cleanup script actually cleaned up the old files going back in time instead of just moving forward. 

You can check $FWDIR/log to see what's sitting around in there:

If there are lots of old flat file logs still sitting there, maybe try removing some and see if that helps improve your log index retention by relieving some disk space? Usually, I just use the rm command with some wildcard to do small blocks at a time.

[Fred_Howard]

Thanks Daniel!  I appreciate your help.

[nurka_0522]

hi, i need to clear var/log data files on the disk log files used too much capacity. Pls help me. we have checkpoint storage is full

[_Val_]

Look here for some guidance: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Dror_Aharony]

Please state your version.

only 58GB in /var/log/ (Logs partition) is very low.

What is your ~log-rate/sec? Do you use SmartLog/Log-Indexing?

Add more disk-space.

Assign it to /var/log/ specifically using sk94671 (assuming VM) & lvm_manager tool. see:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Daniel_Taney]

Sorry... also maybe try a smartlogstop / smartlogstart after disk space gets freed up?