Filling var/log space due /opt/CPsuite-R80/fw1/tmp/dlp

[Filip_Wennerhul]

Hi, anyone had an issue with not /var/log/opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/dlp not being cleaned.

The customer are running MTA and Sandblast remote emulation and this is filling up on the gateway. No sandblast agent. There is this sk117634

This is an improved script that probably will help but i would like to know why the orignal script is failing. How long does it take between cleaning the directory (1 month or longer?). Can i see some logs regarding the execution of this script, if its failing to execute?

I found this script teCleanupOldFiles.elg

Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/te_files/ ...
Thu Apr 18 10:17:32 CEST 2019: Above threshold (27%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: Aquired lock, calling cleanupDirectory /tmp/ 4320 0 /tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /opt/CPsuite-R80/fw1/CTX/CTX00001/tmp/te/te_tmp_files/ ...
Thu Apr 18 10:17:32 CEST 2019: cleanupDirectory _filesPattern is /tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz
Thu Apr 18 10:17:32 CEST 2019: STARTING cleanup...
Thu Apr 18 10:17:32 CEST 2019: Above threshold (27%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: running command: find /tmp/ -mindepth 1 -maxdepth 1 -cmin +4320 -print | grep -P "/tmp/(\{[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}-?)+[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}\.tar\.gz" | xargs -d '\n' rm -rf
Thu Apr 18 10:17:32 CEST 2019: Try acquire lock, on directory /var/log/py/jail/raw_files
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /var/log/mal_files/ ...
Thu Apr 18 10:17:32 CEST 2019: Aquired lock, calling cleanupDirectory /var/log/py/jail/raw_files 1440 0
Thu Apr 18 10:17:32 CEST 2019: cleanupDirectory _filesPattern is
Thu Apr 18 10:17:32 CEST 2019: Above threshold (16%) - Aggressive mode not required
Thu Apr 18 10:17:32 CEST 2019: FINISHED cleanup on directory /tmp/ ...

but this does not seem to include this directory.

Can anyone help me find out why the original script is failing. This started happen recently without  any noticable change.

regards

[Nick_Doropoulos]

Hi Filip,

I'm afraid that the sk you mention is only visible to customers...

[G_W_Albrecht · Accepted solution]

sk117634 is only one sk about such issues:

• sk110555 - "Used disk space percent" counter in the $FWDIR/log/emaild.mta.elg log file shows unreali...
• sk92907: Threat Emulation inspection failure due to disk space shortage
• sk101149 - "Error: Disk space usage is above allowed value" is displayed in SmartView Monitor for Th...
• sk106040 - False alerts in SmartEvent GUI / SmartView Monitor about low disk space on Security Gatew...

But what i do not understand is why you would like to know why the orignal script is failing. I am sure there is a reason, some people will even call it a bug, but for me it is most valuable to get a solution to the customers issue. An explanation may be fine, but how could it help you in this case ?

In sk117634, we read: There is a Python script on Security Gateway that runs periodically and is responsible for removing old temporary files that were not cleaned by the regular e-mail flow. However, in case the list of temporary files is getting too long until the next call to this script, it would fail to delete them, and the list of files would get bigger over time.

Does that not explain enough ?

[Filip_Wennerhul]

Okey, you have a point. I will accept this solution and add the script according to SK.