Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Crzcarlo
Participant

/tmp/log/local almost full in 1590 device

Jump to solution

Hi everyone


I am working on a inherited Check Point structure with sever models and firmwares. By monitoring them, I notices that a 1590 R80.20SP has amost always the /tmp/log/local folder used at about 90%:

tmpfs
20.0MB
5.9MB
14.1MB
30%
/tmp
tmpfs
40.0MB
18.1MB
21.9MB
45%
/fwtmp
/dev/mmcblk1p8
4.7GB
517.6MB
4.0GB
11%
/logs
/dev/mmcblk1p11
7.8GB
959.4MB
6.4GB
13%
/storage
/dev/mmcblk1p3
692.7MB
417.1MB
225.1MB
65%
/pfrm2.0
tmpfs
14.0MB
11.6MB
2.4MB
83%
/tmp/log/local
tmpfs
500.0MB
0.0KB
500.0MB
0%
/tetmp

 

Other similar devices on the same infrastructure (1470 R77.20.75 and R77.20.87) have this folder used at 0%. I wonder if it is a normal behavior for this device or if there is something that needs to be fixed. I know that it's a folder stored on the volatile memory but I'm not able to find any useful information.


Thank you in advance!

0 Kudos
1 Solution

Accepted Solutions
G_W_Albrecht
Legend
Legend

 See my last post in What information is stored in /storage partition :

/tmp/log/local is the folder for local security log files folders - if you have a local management, older folders (0 1 2 3 4 5 6...) will be deleted. If managed centrally, logs are sent to the log server, so this /tmp partition is not so important anymore

So looks like there is local logging switched on in Embedded GaiA WebGUI !

Concerning R80.2SP: I did encounter the same issue a year ago, but lastly succeeded to set it to correct version. Use newest Jumbo + Dashboard on Management, and upgrade to R80.20.10 !

View solution in original post

5 Replies
PhoneBoy
Admin
Admin

First of all, R80.20SP is specific to Maestro, not SMB appliances like the 1500.
A TAC case suggests this is used for log storage, but I don't think it's security/traffic logs.
It also mentions a reboot will clear unneeded files from this directory.

Crzcarlo
Participant

Thank you for the reply.

Indeed from the GUI of the 1590 device I can see that it's using the Version: R80.20.01 (992000899). From the SmartConsole however I can only choose the Version R80.20, and than in the Gateway & Servers tab it reports R80.20SP (see attached file).

Now I wonder if this is just a UI problem or can cause come issue, since once a week (only for this specific device) the connection to the SmartConsole goes down and we have to reboot it.


@John_Fleming  do you mean that you checked the firewall access logs and you think that they are stored in the /tmp/log/local/ folder?

0 Kudos
John_Fleming
Advisor

I think its normal. Mine is about the same. I'm thinking its acting like a cache for firewall access logs when using the gui to search the logs. The contents of the dir is for sure access logs. 

[Expert]# cd /tmp/log/local/
[Expert]# df -h .
Filesystem Size Used Available Use% Mounted on
tmpfs 14.0M 9.8M 4.2M 70% /tmp/log/local
[Expert]#

0 Kudos
G_W_Albrecht
Legend
Legend

 See my last post in What information is stored in /storage partition :

/tmp/log/local is the folder for local security log files folders - if you have a local management, older folders (0 1 2 3 4 5 6...) will be deleted. If managed centrally, logs are sent to the log server, so this /tmp partition is not so important anymore

So looks like there is local logging switched on in Embedded GaiA WebGUI !

Concerning R80.2SP: I did encounter the same issue a year ago, but lastly succeeded to set it to correct version. Use newest Jumbo + Dashboard on Management, and upgrade to R80.20.10 !

View solution in original post

Crzcarlo
Participant

Thank you so much, the local logging was indeed incorrectly switched on! I will also resolve the version issue as soon as possible.

0 Kudos