Unable to install latest Deployment Agent

[jyrbn]

Hi,

While trying to install the hotfix for the CVE-2024-24919, we encountered an error, we couldn't manually create a backup, and GAIA gui asked us to install the latest version of the Deployment Agent before we can proceed to use the CPUSE.

We tried doing this but encountered this error. 

Any documentation that can help with freeing additional space? 

System Details:

Version: R81

Model: 6400

Thanks. 

[the_rock]

Your answer is right in the screenshot mate...it says insufficient space in /var/log/CPda/repositiory dir, so what you need to do it free some space there and then it will work.

Best,

Andy

[jyrbn]

Yes, I get that part, but is there any documentation I can use as a guide to do this?

Thanks!

[the_rock]

Not really...since Gaia is based on Linux, its typical linux command. You can do below from expert:

say you wish to delete files bigger than 500Mbs, though you can use any file size

do this:

find  /var/log/CPda/repository -size +500M

That will look for ANY files in that dir bigger than 500Mbs, then you can use rm to delete them. 

No need to reboot or restart anything or push policy, once done, just go back to web UI and it will work 100%.

Andy

[jyrbn]

Thank you, will try this next time.

[the_rock]

From my lab. 

Andy

[Expert@CP-STANDALONE:0]# find /var/log/CPda/repository/ -size +500M
/var/log/CPda/repository/CheckPoint#CPUpdates#All#6.0#5#4#BUNDLE_R81_20_JUMBO_HF_MAIN#65/Check_Point_R81_20_JUMBO_HF_MAIN_Bundle_T65_FULL.tgz
[Expert@CP-STANDALONE:0]#

[emmap]

Deleting files in the repository is not always a great idea, as it can cause you problems when it comes to future upgrades or rollbacks. 

Check the whole /var/log/ partition rather than the specific repository folder, as that's all the same disk space. Do you have any old backups or snapshots in there you can remove? Has the gateway been logging locally and filled up the disk that way?

[jyrbn]

Now that you mentioned it, the GW has not been logging properly also, I think this might also be due to the disk space issue. 

This is why we are looking for any documentation regarding freeing up disk space since we want to know which files are safe to delete. Do you know if there is any?

Thanks.

[emmap]

If your gateway has been logging locally then I suggest you look up the 'fw lslogs' and 'fw logfetch' commands, which will help you pull those local log files over to the management server. You run them on the management server, and when the log files are fetched they are removed from the gateway. This will ensure that you don't lose logs while also freeing up log space.

[the_rock]

This is a good reference.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Disk-Space-issues-on-Gateway/m-p/161537#M28601

[Andrew_Rawlinso]

A good tool to find what is taking up your disk space is "treesize". You can add it to your gateway by following the instructions below:

1. vi /bin/treesize

2. Paste everything between the hashes below (including the last line with ' on it):

############################
du -k --max-depth=1 | sort -nr | awk '
BEGIN {
split("KB,MB,GB,TB", Units, ",");
}
{
u = 1;
while ($1 >= 1024) {
$1 = $1 / 1024;
u += 1
}
$1 = sprintf("%.1f %s", $1, Units[u]);
print $0;
}
'
############################

3. Save and exit vi:

Esc, followed by ":wq"

4. Change permissions so you can run treesize:

chmod 777 /bin/treesize

5. Run the tool, eg:

cd /var/log
treesize

[the_rock]

O, thats nice, never knew of that. Just did it in the lab, super useful. I know similar can be done with du command, but this is also very useful.

Andy

3.4 GB ./opt
2.7 GB ./files_repository
2.6 GB ./jail
2.5 GB ./CPda
1.8 GB ./AutoUpdater
1.7 GB ./aspose
913.3 MB ./CPDepInst
695.4 MB ./bd
185.6 MB ./py
14.7 MB ./sa
10.9 MB ./CPzetc
7.4 MB ./pg_log
6.5 MB ./hcp
3.2 MB ./audit
2.1 MB ./spike_detective
1.8 MB ./dump
984.0 KB ./anaconda
900.0 KB ./upload
128.0 KB ./crash
104.0 KB ./db_upgrade
104.0 KB ./CPcme
36.0 KB ./scrub
28.0 KB ./routed_db
8.0 KB ./tmp
8.0 KB ./sensor
8.0 KB ./scripts
4.0 KB ./cpupgrade
4.0 KB ./blink
4.0 KB ./autoupdater_hcp_install_info
4.0 KB ./autoupdater_ender_install_info
4.0 KB ./autoupdater_cpsdc_install_info
4.0 KB ./autoupdater_cfu_install_info
4.0 KB ./TEXUpdatesManager
0.0 KB ./zph
0.0 KB ./usim_crash
0.0 KB ./upgrade
0.0 KB ./spool
0.0 KB ./ppp
0.0 KB ./ntpstats
0.0 KB ./mal_files
0.0 KB ./install_policy
0.0 KB ./image
0.0 KB ./hps_pe_store
0.0 KB ./download
0.0 KB ./dlp
0.0 KB ./cvpn_file_upload
0.0 KB ./autoupdater_tun_install_info
0.0 KB ./all_files
0.0 KB ./PackageRepository
0.0 KB ./DL_UPLOADER
0.0 KB ./CPsnapshot
0.0 KB ./CPotelcol
0.0 KB ./CPbackup

[the_rock]

Thats actually true, but, I personally never had issues with it, though I always make sure NOT to delete any files other than tgz used for the upgrade.

Andy