Snapshot question

[the_rock]

Hey guys,

I had a quick question about snapshots on the CP gateways. I had 2 snapshots on my VM fw and each one was about 15 GB and Im trying to figure out where they are stored exactly. I know this was probably asked before, but I cant see disk space change even if you delete the snapshots.

Found below, but could not locate either snapshot in /var/log/CPsnapshot/snapshots OR /var/CPsnapshot/snapshots

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

If someone could confirm, would be great!

Thanks as always!

[genisis__]

lvm_manager may help.

[the_rock]

Thank you for that...it does show unallocated space, which matches with the snapshot management page in web UI, BUT, still does not mention the directory.

[K_montalvo]

We can do remotelly for this after i finish a current project brother

[the_rock]

Yes sir 😉

[G_W_Albrecht · Accepted solution]

On Gaia OS, snapshots are not files, but disk volumes that are stored as a disk partition, therefore the directory name is not relevant here. It is possible to view list of virtual drives by running the "lvs" command (in the Expert mode). See sk92261: Snapshot location on Gaia and SecurePlatform  and sk172523: Unable to restore snapshot because CLISH shell hangs for details !

[the_rock]

Thanks G! I will check it a bit later and update.

[the_rock]

You are 100% right...my colleague and I looked at that sk first yesterday, but missed part you indicated. Thanks as always sir!

[G_W_Albrecht]

This leads to the fact that according to sk115144:

When exporting a snapshot, the Gaia OS transfers the relevant files for a snapshot to the /var/log/ partition, then compresses all files into one archive file.

For this operation, the requirement is that the free space in the /var/log/ partition is at least twice the size of the final snapshot.

😩

[Tobias_Moritz]

Regarding sk115144: If I am not wrong, you can reduce that from twice the size of the final snapshot to size of the final snapshot when you do the export (with clish) directly to a mounted remote file system (e.g NFS or CIFS). This way, the copy is done to local file system (/var/log partition) but the archive is created on the remote file system.

Instead of a mounting a remote filesystem, you can also mount some storage from a USB thumbdrive or something like that.