Check Point 23800 appliances / VSX/VSLS / Files in /tmp folder

[Kris_Pellens]

Dears,

The /tmp folder on our gateway is 17 GB in size.

It contains files like:

- temp_tar_exclude_*

- ddrOutput*

Is it save to delete those files. Or do we have to open a TAC case for this.

Thanks.

Regards,

Kris

[HeikoAnkenbrand · Accepted solution]

Hi @Kris_Pellens

Current status information are stored in the tmp directory. If you delete the content of the directory it can lead to big problems. I would open a TAC case.

[Kris_Pellens]

Thank you Heiko.

Important note: your contribution to Check Mates is excellent. Much appreciated!

[Kaspars_Zibarts]

As far as I can see:

/tmp/temp_tar_[in|ex]clude*.txt are leftovers from backup process and there is no harm removing those:

Note that backup logs show +1hr due to silly timezone setup

Same goes to ddrOutput as that's junk from SW updates checks that are run every 3hrs by default

Interestingly my /tmp is only 100MB with all that junk in it

[Kaspars_Zibarts]

Have you checked the biggest files in /tmp btw?

ls -lSr /tmp

[Kris_Pellens]

Hi Kaspars,

Thank you for your feedback. Attached you'll find the output ls -lSr /tmp.

As you can see, there are dozens of those files which I was mentioning before.

The biggest file is:

-rw-r--r-- 1 admin root 8471503451 Nov 10 21:21 tarBkp.elg

Regards,

Kris

[Kris_Pellens]

Hello Kaspars,

After deleting the leftover files, the size of /tmp went from 17 GB to 8.7 GB.

The file tarBkp.elg is now consuming the most. Can we reduce the size of this file as well?

Not sure why the update leftovers are staying in /tmp? Could it be the Private ThreatCloud we are using?

Kind regards,

Kris Pellens

[Kaspars_Zibarts]

totally - it's only a log of files that have been added to backup and it seems to add new list every time without purging previous... I just grepped mine and saw a unique file appearing 92 (!) times on the same list. I did a test and it re-created new when running backup

[Kaspars_Zibarts]

@_Val_ could you pls bring this up internally with R&D that works with backups - seems to be leaving a lot of garbage in /tmp, in Kris case 17GB! That's leading to root partition exhaustion..

[_Val_]

Let me see what I can do...

[Dov_Fraivert]

Hi Kris

The following backup files can be safely deleted when backup process is not running: tarBkp.elg, tarBkpErr.elg, temp_tar_exclude_*, and  temp_tar_include_*.
A fix will be developed soon to automatically delete these files at the end of the backup execution.

Regarding ddrOutput* files, this will be fixed automatically for all online machines (including clean up of the files) by next week.

Both fixes will be included in the coming JHF’s

[Kris_Pellens]

Thank you Dov. Do you know when the fix will become available?

Thank you all (Heiko, Kaspars, Val, Dov) for the excellent support.

Kudos.

[Dov_Fraivert]

In the coming JHF’s, I will update when they are released, which version interests you?

[Kris_Pellens]

Hi Dov,

R80.20, R80.40, and R81.

Kind regards,

Kris

[Holger_Lange]

Is there any ETA for that fix or an issue ID for the Problem?
It seems the issue still persists today and I have to delete tarBkp.elg every few months

[shubharora734]

Thank you for your feedback. Attached you'll find the output ls -lSr /tmp.