/tmp/log/local almost full in 1590 device

[Crzcarlo]

Hi everyone

I am working on a inherited Check Point structure with sever models and firmwares. By monitoring them, I notices that a 1590 R80.20SP has amost always the /tmp/log/local folder used at about 90%:

tmpfs

20.0MB

5.9MB

14.1MB

30%

/tmp

tmpfs

40.0MB

18.1MB

21.9MB

45%

/fwtmp

/dev/mmcblk1p8

4.7GB

517.6MB

4.0GB

11%

/logs

/dev/mmcblk1p11

7.8GB

959.4MB

6.4GB

13%

/storage

/dev/mmcblk1p3

692.7MB

417.1MB

225.1MB

65%

/pfrm2.0

tmpfs

14.0MB

11.6MB

2.4MB

83%

/tmp/log/local

tmpfs

500.0MB

0.0KB

500.0MB

0%

/tetmp

Other similar devices on the same infrastructure (1470 R77.20.75 and R77.20.87) have this folder used at 0%. I wonder if it is a normal behavior for this device or if there is something that needs to be fixed. I know that it's a folder stored on the volatile memory but I'm not able to find any useful information.

Thank you in advance!

[PhoneBoy]

First of all, R80.20SP is specific to Maestro, not SMB appliances like the 1500.
A TAC case suggests this is used for log storage, but I don't think it's security/traffic logs.
It also mentions a reboot will clear unneeded files from this directory.

[Crzcarlo]

Thank you for the reply.

Indeed from the GUI of the 1590 device I can see that it's using the Version: R80.20.01 (992000899). From the SmartConsole however I can only choose the Version R80.20, and than in the Gateway & Servers tab it reports R80.20SP (see attached file).

Now I wonder if this is just a UI problem or can cause come issue, since once a week (only for this specific device) the connection to the SmartConsole goes down and we have to reboot it.

@John_Fleming  do you mean that you checked the firewall access logs and you think that they are stored in the /tmp/log/local/ folder?

[John_Fleming]

I think its normal. Mine is about the same. I'm thinking its acting like a cache for firewall access logs when using the gui to search the logs. The contents of the dir is for sure access logs. 

[Expert]# cd /tmp/log/local/
[Expert]# df -h .
Filesystem Size Used Available Use% Mounted on
tmpfs 14.0M 9.8M 4.2M 70% /tmp/log/local
[Expert]#

[G_W_Albrecht · Accepted solution]

 See my last post in What information is stored in /storage partition :

/tmp/log/local is the folder for local security log files folders - if you have a local management, older folders (0 1 2 3 4 5 6...) will be deleted. If managed centrally, logs are sent to the log server, so this /tmp partition is not so important anymore

So looks like there is local logging switched on in Embedded GaiA WebGUI !

Concerning R80.2SP: I did encounter the same issue a year ago, but lastly succeeded to set it to correct version. Use newest Jumbo + Dashboard on Management, and upgrade to R80.20.10 !

[Crzcarlo]

Thank you so much, the local logging was indeed incorrectly switched on! I will also resolve the version issue as soon as possible.

[Greg_Harbers]

Hi,

I have upgraded several 1550/1590 gateways to R80.20.30 and have noticed that in Smartconsole, any such devices are reporting no value in the version column. If I simply edit the gateway and click OK, the version returned is R80.20SP.

You said you resolved this with latest jumbos and smartconsole version. what versions were you using?

in my case, the mgmt server is R80.40 take 118, smart console build 423

thanks

Greg

[G_W_Albrecht]

I am using R81 SMS now - in most recent Dashboard, you select hardware 15x0 and OS R80.20.

R80.40 SmartConsole Releases has version 424, try this one...