Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Tony_Graham
Advisor

R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

I logged into Smart Console yesterday late and noticed my SG3200 is sporting a red X.

Investigating I discovered under Device and License Information the error:

"Error:Disk Space usage is above allowed value."

Now normally that error would be fairly self explanatory, except it isn't in this case.

1) I do not use local threat emulation. We are using Threat Cloud. Therefore no disk limits are set.

2) Disk space on the appliance is mostly empty sitting at 22Gb free.

Logging into the SG directly, GAIA is showing no issues.

 

45 Replies
RS_Daniel
Advisor

Hello, 

Can you provide output of following command? ls -l /var/log/files_repository/images

If it is not empty the emulation images are being downloaded to your local appliance, i've seen this in an appliance whith remote emulation configured (NOT locally).

Regards

Tony_Graham
Advisor

[expert@host:0]# ls -l /var/log/files_repository/images

total 0

[expert@host:0]#

hostname was edited. It is not 'host'.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

A 3200 appliance has ~320GB storage (total) of which part is allocated to /var/log  it's needs 20% free in that volume.

What's the output of "cpstat threat-emulation" on the gateway?

 

Refer also: sk101149 / sk92907

CCSM R77/R80/ELITE
Tony_Graham
Advisor

Same as posted. Status 2 Error Disk space usage is above allowed value.

0 Kudos
the_rock
Legend
Legend

Have a look at this sk. I would still double check the disk space on the appliance.

Andy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Blason_R
Leader
Leader

Best way I always follow - few quick trick

cd /var/log

du -hs * | grep -E 'M|G|T'

```

And it would show the usage; this would help to clear the files more conveniently.

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
Tony_Graham
Advisor

There are some large files on /var/log but I have no idea what can be cleared.

Is there an SK outlining files that can be deleted. or cat /dev/nulled?

0 Kudos
the_rock
Legend
Legend

Are you able to send a screenshot? Blur out any sensitive info.

Andy

0 Kudos
Tony_Graham
Advisor

Screenshot of what?

0 Kudos
the_rock
Legend
Legend

Large files you see in /var/log.

0 Kudos
the_rock
Legend
Legend

This is great command our mate @G_W_Albrecht provided in a different post:

find / -type f -size +100000 -exec ls -lh {} \; 2> /dev/null | awk '{ print $NF ": " $5 }' | sort -nk 2,2

So say to search for files bigger than 500 MB in /var/log, just run this:

find /var/log -type f -size +500000 -exec ls -lh {} \; 2> /dev/null | awk '{ print $NF ": " $5 }' | sort -nk 2,2

 

Andy

Tony_Graham
Advisor

There is like 6 pages of files so screenshots a bit difficult. However, there is a gigantic file:

/var/log/aspose/opt/CPsuite-R81.10/fw1/aspose_jail/proc/kcore.

It is 140737486266368 in size.

0 Kudos
the_rock
Legend
Legend

Hm, I dont pretend to know answer to it, so I will let someone else confirm, but I found below, which does make sense.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Andy

Tony_Graham
Advisor

I have a 8 versions of these as well. They are 1-5G each

/var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#69/Check_Point
_R81_JUMBO_HF_MAIN_Bundle_T69_FULL.tgz

0 Kudos
Tony_Graham
Advisor

I suspect these can be removed but is there a process within SmartConsole for doing so?

I don't like munging around in the filesystem. Not sure why CP allows these types of conditions

to occur in the first place. I keep clean systems on the front end so I don't understand why it's

so trashy on the back side.

0 Kudos
Tony_Graham
Advisor

Screenshot_20221202_110949.pngThis is where the .tgz files are sitting.

0 Kudos
the_rock
Legend
Legend

Ok, just something important (customer did this once without knowing and they could not install new jumbo hotfix).

Its OK to delete files from /var/log/CPda/repository

Its NOT good to delete ones from below dir:

/opt/CPda/backup

0 Kudos
G_W_Albrecht
Legend
Legend

Seem to be very old update files - all not R81.10 can be deleted CPinfo excluded 😎)

CCSE CCTE CCSM SMB Specialist
Tony_Graham
Advisor

So let's assume your message got lost in the train here and I mayyy have deleted a cpinfo...

How does one fix that or am I now completely hosed...

0 Kudos
G_W_Albrecht
Legend
Legend

These are the installed Jumbo Fixes! To free this space, use a new GA Jumbo HF:

- uninstall all Jumbo takes (1 command)

- delete all uninstalled Jumbo Packages (if not visible in GAiA WebGUI, from CLI)

- install latest GA Jumbo

CCSE CCTE CCSM SMB Specialist
0 Kudos
Tony_Graham
Advisor

Not sure I am following you.

These are the only packages that are installed according to GUI.

s1.png

0 Kudos
Tony_Graham
Advisor

Okay so kcores can be ignored.

Tony_Graham
Advisor

I found in the GUI where they were hiding. I will purge them.

0 Kudos
the_rock
Legend
Legend

Where was it?

0 Kudos
Tony_Graham
Advisor

I am back to Green but the GUI is not reflecting all the versions sitting on the disk.

I had to use the drop down to select 'All' packages, instead of Installed. Then I could see that there were packages downloaded that were just sitting there.

 

0 Kudos
the_rock
Legend
Legend

I thought you were talking about smart console, but you meant web UI, gotcha.

0 Kudos
Tony_Graham
Advisor

Sorry I confused you. I've been bouncing around between CLI, WebUI and SmartConsole.

0 Kudos
the_rock
Legend
Legend

All good man, no sweat : - )

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events