/var/log/jail Folder

[Jason_Grubbs]

We have a 5200 R80.40 that is running out of space in /var/log:

I found that there was a jail folder located inside of /var/log:

Further digging resulted in finding 37G of files located in the following folder:

/var/log/jail/opt/CPsuite-R80.40/fw1/dlp/ftp/

This firewall does not have DLP enabled

Any ideas if these files are ok to delete?

[the_rock]

I would definitely back them up first, but seems safe to remove from what I see in my lab.

[Jason_Grubbs]

Is the /var/log/jail folder even necessary?  Why was it created?

[the_rock]

Do they use MTA for DLP/Email Security/AV?

That would possibly explain the use of that particular log folder.

[Jason_Grubbs]

We use AV with the Threat Prevention blade.

[Jason_Grubbs]

[the_rock]

That might explain it...honestly, I would verify with TAC, because I see that folder in my lab as well, but I dont use any of those blades, so not 100% sure.

[Jason_Grubbs]

Ok, I will reach out to TAC

[the_rock]

Definitely better to get an official answer, because if I were you, I would certainly be a bit worried about removing stuff thats 37 GB in size, specially if Im not 100% sure the purpose for it. I mean, as I stated before, I would backup everything from that folder anyway first, but let support clarify for you beforehand. In my lab, that folder is only few MBs, so there is certainly something in your environment causing the folder to fill up rather quickly.

Andy

[Tal_Paz-Fridman]

Hi

After consulting R&D, the issue is known and is handled in two parts – one is already integrated into R80.40 Ongoing Take 126.

The other fix will be included in the next JHF.

@pavelko 

[genisis__]

Can you expand?  Is there a SK?

[Tal_Paz-Fridman]

I also agree.  I asked R&D owner to publish an SK including instructions on how to clear up the space.

[the_rock]

I agree with @genisis__ . SK would be nice...also, considering that @Jason_Grubbs has 37 GB worth of space there (which is pretty significant), it poses a question if its really safe to remove in the first place.

[genisis__]

100%!

[Jason_Grubbs]

I have not yet seen an SK for this issue.  Still exists in R81.  I had to remove another 36GB today from the jail folder.