Delete Logs

[fiq_c]

We are planning to upgrade our Checkpoint devices to R81.10.

From R81.10 Release Notes its require free disk space for 20 GB in the root partition and 10 GB in the /var/log partition.

I found that our device don't have 10 GB free disk space in /var/log partition:

I found folder that consume 45GB in /var/log/opt/CPsuite-R77/fw1/log/:

There is a lot of old log files:

Exisiting version of the device is R80.10.

My question:

1. Is it safe to delete the log file with extension .log, logptr, logaccount_ptr and loginitial_ptr?

2. If I delete with command example: "rm 2019-08-23_002241_534.log" is it the correct way?

3. Is there negative impact to the device if I delete it?

I have been searching but not found the article (SK) about procedure to delete the files.

I'm quite new to CP world, please advice.

Thanks.

[_Val_]

Hi, there are quite a few discussions about this topic you can find in the community, and I believe your answers are all there.

Please start here: https://community.checkpoint.com/t5/Management/Howto-automatic-remove-log-entries-older-then-x-days-... and then let me know if you need any further assistance. 

[Tobias_Moritz]

Val, I think the key point here is, that this box is running R80.10 currently (yes, out of support) and these logs are in path /var/log/opt/CPsuite-R77/fw1/log/.

Looks that are left-overs from an old in-place upgrade from R77 to R80.

I would say, its save to manually deleted them. Any other options?

[_Val_]

If they do not need those logs, then yes. It is hard to make a general recommendation here, without additional info. Do they need to keep the logs? What is the log rotation policy and audit requirements? I do not know.

If they feel they do not need those logs, sure, they all can be deleted. 

However, considering the main goal here is upgrading to R81.10, and knowing it cannot be done in a single shot from R80.10, I would suggest not an upgrade in place, but an advanced upgrade. They do want to benefit of the new file system with 3.10 kernel, so I would suggest an advanced upgrade with reimaging or even moving to a new HW. 

[fiq_c]

Hi Val and Tobias.
Thanks for respond in this Post.

We dont need to keep the logs, our concern if we delete the logs there is any negative impact to the device like the device become crash and etc.

Today I finally found the document that explain to delete the logs.
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

So it is safe to delete the logs.

FYI, our management server version is R80.30 kernel 3.10 and there is some gateway cluster still using version R80.10 that don't have 10 GB free disk space in /var/log partition like I explain in previous post.

from R81.10 Release Note

I can upgrade management server R80.30 kernel 3.10 to R81.10 directly and cluster gateway version R80.10 to 81.10 directly, CMIIW.

Thanks.

[_Val_]

Please note, @fiq_c , the SK you linked above is for old and unsupported Gaia versions, R77.30 and below. It cannot be directly applied to your case. 

That said, I am glad your issue is resolved and you can move on with the upgrade