Gaia disk cleaunp recommendation script

[the_rock]

This script would show current disk usage pre all directories, as well what is safe to remove. Please run dos2unix and chmod 777 on it before testing it.

Lab output:

[Expert@LIN_FW_01:0]# ./gaia_disk_cleanup.sh

[2026-01-21 10:26:57] Filesystem usage (df -h):
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current 32G 12G 21G 36% /
/dev/sda2 291M 89M 187M 33% /boot
/dev/sda1 60M 11M 50M 18% /boot/efi
/dev/mapper/vg_splat-lv_log 178G 11G 168G 6% /var/log
tmpfs 16G 116M 16G 1% /dev/shm

[2026-01-21 10:26:57] Inode usage (df -i):
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/mapper/vg_splat-lv_current 16777216 84883 16692333 1% /
/dev/sda2 76912 621 76291 1% /boot
/dev/sda1 0 0 0 - /boot/efi
/dev/mapper/vg_splat-lv_log 93323264 53259 93270005 1% /var/log
tmpfs 4065779 181 4065598 1% /dev/shm

[2026-01-21 10:26:57] Detected FWDIR-ish path: /opt/CPsuite-R81.20/fw1 (logs often in $FWDIR/log/*.log - binary format; rotate/export instead of deleting) [5](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...)

[2026-01-21 10:26:57] Top directories by size (common mount points, same filesystem only):
== /var/log ==
11G /var/log
6.6G /var/log/CPda
2.1G /var/log/opt
802M /var/log/AutoUpdater
572M /var/log/CPDepInst
72M /var/log/sa
16M /var/log/audit
8.3M /var/log/hcp
2.3M /var/log/anaconda
1.6M /var/log/spike_detective
388K /var/log/CPzetc
104K /var/log/db_upgrade
48K /var/log/routed_db
8.0K /var/log/sensor
8.0K /var/log/scrub
== /var ==
798M /var
727M /var/opt
68M /var/lib
3.3M /var/CPsnapshot
104K /var/CPbackup
72K /var/tmp
32K /var/cache
8.0K /var/spool
8.0K /var/db
0 /var/preserve
0 /var/nis
0 /var/local
0 /var/kerberos
0 /var/gopher
0 /var/empty
== /opt ==
8.2G /opt
2.8G /opt/CPsuite-R81.20
2.6G /opt/CPda
1012M /opt/CPshrd-R81.20
263M /opt/CPcvpn-R81.20
259M /opt/CPDepInst
254M /opt/CPbios_upg
212M /opt/CPInstLog
178M /opt/OSHF
135M /opt/CPotelcol
71M /opt/CPdiag
69M /opt/AutoUpdater
63M /opt/HealthCheckPoint
41M /opt/CPNacPortal
33M /opt/CPUserCheckPortal
== /home ==
124K /home
52K /home/andy
20K /home/admin
16K /home/don
12K /home/monitor
12K /home/chad
12K /home/_nonlocl
== /tmp ==
4.7M /tmp
188K /tmp/diagnostics
8.0K /tmp/bladesStatus.zs6nmBLomT
8.0K /tmp/bladesStatus.zlHRJHkYIS
8.0K /tmp/bladesStatus.zXIAIbconK
8.0K /tmp/bladesStatus.zTdvM3NgLC
8.0K /tmp/bladesStatus.zRJYlQC2Ep
8.0K /tmp/bladesStatus.zOiyB8yExA
8.0K /tmp/bladesStatus.zEGPh3s81d
8.0K /tmp/bladesStatus.yv2eCa20EM
8.0K /tmp/bladesStatus.yqRpmiENtB
8.0K /tmp/bladesStatus.yJzwGsLdJm
8.0K /tmp/bladesStatus.yE1joKkPBf
8.0K /tmp/bladesStatus.xrrEsXCTPS
8.0K /tmp/bladesStatus.xhh0Cyh2Te

[2026-01-21 10:26:57] Candidate area: Gaia system backups in /var/log/CPbackup/backups (*.tgz) [1](https://supportcenter.checkpoint.com/supportcenter/portal?solutionid=sk91400)[2](https://sc1.checkpo...)
Old backups (>30 days):

[2026-01-21 10:26:57] Candidate area: CPUSE repository at /var/log/CPda/repository (downloaded packages). Prefer removing via CPUSE; do NOT delete last_take. [3](https://community.checkpoint.com/t5/Management/var-log-CPda-repository/td-p/229973)
Largest package files under /var/log/CPda/repository:
3188920600 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#119/Check_Point_R81_20_jumbo_hf_main_Bundle_T119_FULL.tgz
3186719798 /var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#118/Check_Point_R81_20_jumbo_hf_main_Bundle_T118_FULL.tgz

[2026-01-21 10:26:57] Candidate area: old-version log folders under /var/log/opt (e.g., CPsuite-R80.xx). Remove only if you no longer need pre-upgrade logs; SmartLog may rely on symlinks. [4](https://community.checkpoint.com/t5/General-Topics/Old-versions-in-var-log-opt-security-gateway/td-p...)
Top CPsuite/CP* directories by size under /var/log/opt:
1.1G /var/log/opt/CPsuite-R81.20
1019M /var/log/opt/CPshrd-R81.20
24K /var/log/opt/CPotlpAgent
0 /var/log/opt/CPcvpn-R81.20

[2026-01-21 10:26:57] Candidate area: old compressed files under /var/log (review before removal).

[2026-01-21 10:26:57] Reminder: Don’t delete /opt/CPsuite-R81.20/fw1/log active logs. Use supported rotation/export (fw/fwm logswitch, logexport) instead. [5](https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...)

[2026-01-21 10:26:57] Reminder: Snapshots are LVM volumes; manage/delete via snapshot tools, not file deletion. [8](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Gaia_AdminGuide/Topics-GAG/S...)

[2026-01-21 10:26:57] Done.