Low Disk Space on /pfrm2.0

[Theo]

Gateway: CheckPoint 1100

Version: R77.20

OS: Gaia

Most of my 1100's appliance have this error Low Disk Space on /pfrm2.0, how can this be resolved? Any housekeeping to be done? I tried searching but couldn't find applicable solution about this problem.

Thanks.

[PhoneBoy]

Few questions:

1. What blades are you running on the 1100?

2. How is it managed? (Local or central)

3. How are you being notified it has low disk space?

In general the non-volatile storage on an 1100 is fairly limited.

Recent OS image use a significant amount of this.

[Theo]

Thanks for reply Dameon Welch-Abernathy‌

- Blades:

• Firewall
• IPSec VPN
• Identity Awareness
• Application Control
• URL Filtering
• Qos

- Centrally Managed

- How are you notified? I'm using Zabbix monitoring tool

[Danny]

In central management the logs dir should not be filled up that much as logs are sent to central management. Do you have a SDHC card inserted into the appliance for log storage?

[Theo]

Hi Danny, none we don't use SDHC card in our appliances

[HristoGrigorov]

Can you please provide the output of the following commands:

# du -sh /logs /storage

# ls -l /logs /storage

[Theo]

Hi Hristo Grigorov‌, please see below

[Expert@fw-HQ]# du -sh /logs /storage

134.5k /logs

62.6M /storage

[Expert@fw-HQ]#

[Expert@fw-HQ]# ls -l /logs /storage

/logs:

-rw-r--r--    1 root     root        20449 Jan  8 18:01 boot_log

-rw-r--r--    1 root     root          280 Jan  3 20:36 connectivity.log

-rw-r--r--    1 root     root         4386 Jan  3 20:28 messages-1546522095.gz

-rw-r--r--    1 root     root       111952 Jan  3 20:36 upgrade_image

/storage:

drwxr-xr-x    5 root     root            0 Jan  4 03:29 amw

drwxr-xr-x    4 root     root            0 Jan  4 03:29 amw_kss

drwxr-xr-x    3 root     root            0 Jan  4 03:29 appi

drwxr-xr-x    3 root     root            0 Jan  4 03:29 av

drwxr-xr-x    2 root     root            0 Jan 14 08:20 extender

drwxr-xr-x    3 root     root            0 Jan  3 20:32 ips

drwx------    2 root     root            0 Jan  8 20:06 pm_contexts

-rw-r--r--    1 root     root            0 Jan  3 20:28 rc.out

drwxr-xr-x    3 root     root            0 Jan  9 00:56 state

[Expert@fw-HQ]#

[HristoGrigorov]

Thanx, looks quite ok to me. Are you sure Zabix is not set to alarm at very high threshold? Is it set to monitor by size or by percentage?

[G_W_Albrecht]

I agree that this must be a wrong threshold setting - a full flash should make policy install impossible...

[G_W_Albrecht · Accepted solution]

Have you ever experienced a flash-full event with these devices after getting a low disk space alarm ? Policy installation fails with "There is not enough disc space on the device" if there is insufficient space in the /pfrm2.0 directory.

sk128092: Policy installation to Centrally Managed SMB device fails due to lack of disk space

sk126372: Policy installation on SMB appliances fails with "Load on Module failed - not enough disc ...

sk98606: Policy installation / fetch fails on Centrally Managed 1100 appliance due to insufficient d...

[Ilmo_Anttonen]

Hi,

I found this thread when searching for installation fail caused by lack of disc mem. My outputs of du -sh /logs /storage is about half of the above example output. I've tried all methods in the SKs except increase the fwtmp partition size.

Actually, enabling the new feature did nothing. Here's before and after in the below screen shot:

We don't have the IPS blade enabled on these but I understand it is still stored on the SMB devices. Remains to try and disable the server protections according to sk105217 and maybe increase fwtmp partition size.

we've got hundreds of these so it's a bit of an headache when you suddenly cannot install policy on them :l

[Ilmo_Anttonen]

Update,

Since setting the new feature to True I was actually able to install on the two GWs which I tried it on. Despite there being no visible change in the disk usage.

[HristoGrigorov]

I think you should not worry about /pfrm2.0 (who on Earth came with this dir name ) because it is has more or less static content while appliance is operational.

But /storage and /logs are different story and there you could remove this and that. Like you may check and remove possible core dumps from /storage or messages log backups (also stored there). 

[Clemens_Swarows]

Hey Darius Manabat,

Solution Title: Policy installation on SMB appliances fails with 'Load on Module failed - not enough disc space'

Solution ID: sk126372

=> this helped us with our 1100 smb appliances.