This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Disk, Log Disk, Root Partition is Filling Up

Firmware Version: 9.408-0

We have recently been having issues with our Data Disk, Log Disk, and Root Partition filling up very fast. Multiple emails come in every day notifying us about each of these.

Currently:

Data Disk - 91%

Log Disk - 91%

Root Partition - 91%

I have done some research into what could be causing these problems and have been unsuccessful in resolving it. I tried to delete old logs which had no effect. We have Automatic Log File Deletion set to delete logs after 30 days.

The ten biggest folders are:

The results of df -h are:

I have not yet tried /etc/init.d/postgresql92 rebuild because we are hoping to have no downtime on our system (or very minimal downtime).

Is there something else we can do to see where these issues are coming from and how we can correct them?

Thanks!



This thread was automatically locked due to age.
  • Hi Rachelle,

    The quickest way to resolve this is to rebuild database using the command /etc/init.d/postgresql92 rebuild but, you have to loose the reporting data.

    You can also try another way if that helps, go to the directory and remove the files. 

    cd /var/storage/pgsql92/data/pg_xlog


    rm 000000010000000800000XX

    Make sure to keep the last few files on the disk, rest can be deleted.

    Hope that helps. 

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • Hi, Rachelle, and welcome to the UTM Community!

    Sachin gave you the answer.  After you're down to under 16 items in that directory, do an ll to see the age of the archive_status directory.  You can delete anything older than that.  That will normally leave 2 or 3 files in addition to archive_status.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Thank you for the help. We ended up running the command /etc/init.d/postgresql92 rebuild.

    We didn't notice any downtime and this resolved the problem. I am continuing to monitor to see if this will have to be done every so often.

  • If this is not a Sophos hardware appliance, you're not using a disk that's large enough.  If it is a Sophos device, you might consider reducing 'Web Protection Reporting Detail Level' to "Full Domain" in 'Reporting Settings'.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob!

    Thanks for answering the previous questions. i ran into a similar problem with my virtual appliance (ovf template from esx, installed originally in march 2015). i have the logs under control (currently 2% of 5.5 GB) but the data disk keeps filling up.

    my appliance runs firmware 9.414-2 and the license id is 759962

    it startet around amonth ago: the data disk (4.1 GB) fills up with a rate of about 1% every 4 hours. when it reaches 75% it stops, but sends me a mail every 4 hours.

    after running the postgresql92 rebuild command, usage drops to 39%, but then climbs again with the same rate.

    is there a possibility to idendify the cause of the data growth or could i somehow just extend the data disk (space is available!).

    looking forward to hear from you guys - thanks for the great product ond services!

    stefan

  • Hi, Stefan, and welcome to the UTM Community!

    It sounds like you installed the VM with only a 20GB virtual disk - 60GB is the recommended minimum.  It might be best to just get a configuration backup, create a new VM w/60GB and VMXNET3 NICs, and then restore the backup to it.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob!

    Thanks for your answer. i got the last virtual appliance by downloading it from the vmware VA Marketplace (trough a vCenter Server) so it came preconfigured with those disk size values. nevertheless, i've downloaded the latest installer, created a linux vm with 60 GB disk from scratch and installed the firewall using the default setup routine.

    through the dashboard, i just saw that even the new installation without a restore only allocated a 26 GB log partition and a 20 GB data partition.

    do i manually have to extend this data disk?

    by the way: the previous installation reached the 75% disk usage treshold again within 30 days :-/ i'm afraid i'll end up having two firewalls sending me notifications soon :-)

  • If this is a home-use situation, Stefan, that should be adequate.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob

    Please do not get me wrong - i am using this homefirewall since 2015 and was really happy with the functionality. for business use, we have multiple hardware appliances with correct licensing and no issues with them.

    i never had issues with the data partition uage until about 3 months ago where, after an update, the partition startet filling up constantly until 70% usage is reached and the notification alert is triggered. i attach an image to you for better understanding. the only thing that helps me for a month period of time is rebuilding the postgre-sql database.

    seems like a bug to me? i would be happy to help with logs and stuff to improve the software..

  • What do you see when you run the following at the command line?

    du -hsx /var/storage/* | sort -rh | head -10

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA