R81.10 Threat Emulation: Error:Disk Space usage is above allowed value.

[Tony_Graham]

I logged into Smart Console yesterday late and noticed my SG3200 is sporting a red X.

Investigating I discovered under Device and License Information the error:

"Error:Disk Space usage is above allowed value."

Now normally that error would be fairly self explanatory, except it isn't in this case.

1) I do not use local threat emulation. We are using Threat Cloud. Therefore no disk limits are set.

2) Disk space on the appliance is mostly empty sitting at 22Gb free.

Logging into the SG directly, GAIA is showing no issues.

[Tony_Graham]

Why do I have files for R80.10/80.20/80.40 and R81?

None of these are shown in the WebUI. I assume I can just blast them?

There's no way to do it in the WebUI.

Here are some examples:

drwx------  2 admin root  4096 Mar  6  2019 CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#189
drwx------  2 admin root  4096 Aug  8  2019 CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF#203
drwx------  2 admin root  4096 Feb 12  2019 CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF_SC#178
drwx------  2 admin root  4096 Aug  8  2019 CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_JUMBO_HF_SC#214
drwx------  2 admin root  4096 Feb 12  2019 CheckPoint#CPUpdates#All#6.0#4#8#BUNDLE_R80_10_MTA#25
drwx------  2 admin root  4096 Oct 10  2019 CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_CPINFO#T43
drwx------  2 admin root  4096 Oct 10  2019 CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN#103
drwx------  2 admin root  4096 Feb 27  2020 CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN#118
drwx------  2 admin root  4096 Feb 27  2020 CheckPoint#CPUpdates#All#6.0#4#9#BUNDLE_R80_20_JUMBO_HF_MAIN_SC#138
drwx------  2 admin root  4096 May 27  2021 CheckPoint#CPUpdates#All#6.0#5#1#BUNDLE_R80_40_JUMBO_HF_MAIN#118
drwx------  2 admin root  4096 Dec 13  2021 CheckPoint#CPUpdates#All#6.0#5#1#BUNDLE_R80_40_JUMBO_HF_MAIN#139
drwx------  2 admin root  4096 Nov 11  2020 CheckPoint#CPUpdates#All#6.0#5#1#BUNDLE_R80_40_JUMBO_HF_MAIN_SC#88
drwx------  2 admin root  4096 Mar 22  2022 CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#58
drwx------  2 admin root  4096 Aug 26 16:42 CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_JUMBO_HF_MAIN#69
drwx------  2 admin root  4096 Jan  7  2022 CheckPoint#CPUpdates#All#6.0#5#2#BUNDLE_R81_MTA#4

[the_rock]

I dont want to sound ironic now, but you have them because they were never deleted. Trust me, I would say 95% of customers dont bother doing that, but I always mention it.

But yes, I am pretty positive its safe to remove them.

[Tony_Graham]

Actually I never knew it was a thing. A bad assumption on my part that

CP would purge superseded patches.

[the_rock]

They never get deleted on their own and Im pretty positive thats been like that for the last 25 years. I know its annoying to do this,but this is why I always remember to purge these things after major upgrade (even minor) and do disk space check every 3 months. I find that works best...well, for me anyway : - ). Never really had any issues that way. 

[Tony_Graham]

First time I've run into it. Live and learn. Thanks for the help.

[the_rock]

Its all good man! I been dealing with CP 15 years and there are things I learn all the time still : - )

[Tony_Graham]

Only 15 eh? I've been dealing with them since version 2.
My brain is pretty much Jell-O these days.

[the_rock]

Old timer, alright :-))

[Tony_Graham]

Unfortunately. 🙂

[the_rock]

Nothing wrong with that! I find that be a good thing, because, how do they say...with experience comes wisdom...something like that : - )

[Tony_Graham]

You know you've made it when your hair turns white...

assuming you still have any once you've reached the fountain of wisdom.

[the_rock]

haha, probably true.

[nmelay]

FWIW, I install ncdu on just about any Check Point box I get my hands on.
It makes managing low space situations so much easier!

1) Pick the binary from a CentOS 7 system
2) Copy it to $HOME/bin/ncdu (so that it survives upgrades)
3) Run "ncdu -x /" and "ncdu -x /var/log"
4) Profit!

[Tony_Graham]

That's a nice little utility. Thanks.

[nmelay2]

Well, since CentOS 7 is slowly rotting out, I'd now rather recommend using the author's binary instead:

test -d ~/bin || mkdir ~/bin
(cd ~/bin && curl_cli -s --cacert $CPDIR/conf/ca-bundle.crt https://dev.yorhel.nl/download/ncdu-2.5-linux-x86_64.tar.gz | tar xz --no-same-owner --no-same-permissions)

Also, you can now have it in color!
Use the --color=dark command line option, or make it permanent with:

mkdir -p ~/.config/ncdu
echo --color=dark > ~/.config/ncdu/config

Then run  ncdu -x /  or  ncdu -x /var/log .

[_Val_]

Just wondering if deleting the files resolved your issue, @Tony_Graham 

[Tony_Graham]

Yes I went from 97% full to 51% on /var/log.

Thanks.