What's up with ramdisk?

[Dan_Roddy]

Good Morning!

I routinely check my log directory on management server R80.10 (take 70) but this morning I was a little taken back after seeing a directory never observed before: tmpfs  size: 10G used: 0 /ramdisk.  Is my memory challenged?

Where did this come from and what is it used for?  And, if used=0, why?

As always, thanks for  your support.

Dan

[XBensemhoun]

Oh yeah: strange!

Is it an OpenServer or a Smart-1?

Does your R80.10 is from a fresh install or from an upgrade (if so : from which version?)

[Dan_Roddy]

Fresh install in December 2017 on open server in vmware.  But the ramdisk just showed up recently and is still there today.  Oh, almost forgot - I installed the logexporter (sk122323), is that possibly the source?

[G_W_Albrecht]

I did that, too ! And i can see it, too:

[Expert@SMS8010:0]# df -a -h -T
Filesystem    Type    Size  Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current     ext3     20G   12G  6.6G  65% /
proc          proc       0     0     0   -  /proc
sysfs        sysfs       0     0     0   -  /sys
devpts      devpts       0     0     0   -  /dev/pts
/dev/sda1     ext3    289M   24M  251M   9% /boot
tmpfs        tmpfs    3.9G  4.0K  3.9G   1% /dev/shm
/dev/mapper/vg_splat-lv_log     ext3     20G   14G  4.9G  74% /var/log
none   binfmt_misc       0     0     0   -  /proc/sys/fs/binfmt_misc
tmpfs        tmpfs     10G     0   10G   0% /ramdisk

[G_W_Albrecht]

I found /ramdisk in sk116745 "Internal error in a hook script" when installing/uninstalling R77.30 Jumbo Hotfix Accumulator using CPUSE:

/opt/CPInstLog/uninstall_fw1_HOTFIX_R77_30_JUMBO_HF.log file shows:

• [DATE - TIME]: ------ Running Uninstallation Hook: ------
[DATE - TIME]: Running Uninstallation Hook: fw1/bin/uninsthook_fw1_wrapper_HOTFIX_R77_30_JUMBO_HF
[DATE - TIME]: Running hook: /ramdisk/ping/tmp/HFRollback/udtmf/fw1/bin/uninsthook_fw1_wrapper_HOTFIX_R77_30_JUMBO_HF
[DATE - TIME]: Run hook script: /ramdisk/ping/tmp/HFRollback/udtmf/fw1/bin/uninsthook_fw1_wrapper_HOTFIX_R77_30_JUMBO_HF
[DATE - TIME]: Hook log: /opt/CPInstLog/uninsthook_fw1_wrapper_HOTFIX_R77_30_JUMBO_HF.log
[DATE - TIME]: Run: /ramdisk/ping/tmp/HFRollback/udtmf/fw1/bin/uninsthook_fw1_wrapper_HOTFIX_R77_30_JUMBO_HF
[DATE - TIME]: Error in the hook script: (return value=256).
[DATE - TIME]: Failed on doBackout

[Vladimir]

I am on JHFA Take_103 and am not seeing it:

[Expert@SMS8010:0]# df -a -h -T
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
ext3 20G 8.0G 11G 44% /
proc proc 0 0 0 - /proc
sysfs sysfs 0 0 0 - /sys
devpts devpts 0 0 0 - /dev/pts
/dev/sda1 ext3 289M 24M 251M 9% /boot
tmpfs tmpfs 3.9G 4.0K 3.9G 1% /dev/shm
/dev/mapper/vg_splat-lv_log
ext3 20G 5.2G 14G 28% /var/log
none binfmt_misc 0 0 0 - /proc/sys/fs/binfmt_misc
[Expert@SMS8010:0]#

Do you have SmartEvent/Correlation Unit running on it?

[XBensemhoun]

And did you installed Log Exporter - Check Point Log Export ?

[Vladimir]

Nope, do not have it installed, so it is quite possibly your culprit.

[Dan_Roddy]

Yes, Log Exporter is working fine, we have 2 exports running, one to splunk and one to syslog.