Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 8 subscribers
  • Views 4755 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Root partition is filling up

David Haven

I am seeing the below 2 errors.

Root partition is filling up - please check. Current usage: 98%

Log Disk is filling up - please check. Current usage: 91%

Here is the output for my putty session.

Filesystem Size Used Avail Use% Mounted on
/dev/sda6 5.2G 3.3G 1.7G 66% /
udev 5.9G 104K 5.9G 1% /dev
tmpfs 5.9G 248K 5.9G 1% /dev/shm
/dev/sda1 331M 16M 295M 5% /boot
/dev/sda5 62G 9.2G 49G 16% /var/storage
/dev/sda7 81G 70G 7.1G 91% /var/log
/dev/sda8 3.5G 449M 2.9G 14% /tmp
/dev 5.9G 104K 5.9G 1% /var/storage/chroot-clientlessvpn/dev
tmpfs 5.9G 0 5.9G 0% /var/sec/chroot-httpd/dev/shm
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-openvpn/dev
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-ppp/dev
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-pppoe/dev
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-pptp/dev
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-pptpc/dev
/dev 5.9G 104K 5.9G 1% /var/sec/chroot-restd/dev
tmpfs 5.9G 0 5.9G 0% /var/storage/chroot-reverseproxy/dev/shm
/opt/tmpfs 5.2G 3.3G 1.7G 66% /var/sec/chroot-httpd/opt/tmpfs
/var/storage/chroot-smtp/spool 62G 9.2G 49G 16% /var/sec/chroot-httpd/var/spx/spool
/var/storage/chroot-smtp/spx 62G 9.2G 49G 16% /var/sec/chroot-httpd/var/spx/public/images/spx
/etc/nwd.d/route 5.2G 3.3G 1.7G 66% /var/sec/chroot-ipsec/etc/nwd.d/route
tmpfs 5.9G 40K 5.9G 1% /var/storage/chroot-http/tmp
/var/sec/chroot-afc/var/run/navl 5.2G 3.3G 1.7G 66% /var/storage/chroot-http/var/run/navl
tmpfs 5.9G 120K 5.9G 1% /var/storage/chroot-smtp/tmp/ram
<M> mtu:/ # Filesystem Size Used Avail Use% Mounted on
bash: Filesystem: command not found
<M> mtu:/ # /dev/sda6 5.2G 3.3G 1.7G 66% /
bash: /dev/sda6: Permission denied
<M> mtu:/ # udev 5.9G 104K 5.9G 1% /dev
bash: udev: command not found
<M> mtu:/ # tmpfs 5.9G 248K 5.9G 1% /dev/shm
bash: tmpfs: command not found
<M> mtu:/ # /dev/sda1 331M 16M 295M 5% /boot
bash: /dev/sda1: Permission denied
<M> mtu:/ # /dev/sda5 62G 9.2G 49G 16% /var/storage
bash: /dev/sda5: Permission denied
<M> mtu:/ # /dev/sda7 81G 70G 7.1G 91% /var/log
bash: /dev/sda7: Permission denied
<M> mtu:/ # /dev/sda8 3.5G 449M 2.9G 14% /tmp
bash: /dev/sda8: Permission denied
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/storage/chroot-clientlessvpn/dev
bash: /dev: is a directory
<M> mtu:/ # tmpfs 5.9G 0 5.9G 0% /var/sec/chroot-httpd/dev/shm
bash: tmpfs: command not found
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-openvpn/dev
bash: /dev: is a directory
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-ppp/dev
bash: /dev: is a directory
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-pppoe/dev
bash: /dev: is a directory
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-pptp/dev
bash: /dev: is a directory
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-pptpc/dev
bash: /dev: is a directory
<M> mtu:/ # /dev 5.9G 104K 5.9G 1% /var/sec/chroot-restd/dev
bash: /dev: is a directory
<M> mtu:/ # tmpfs 5.9G 0 5.9G 0% /var/storage/chroot-reverseproxy/dev/shm
bash: tmpfs: command not found
<M> mtu:/ # /opt/tmpfs 5.2G 3.3G 1.7G 66% /var/sec/chroot-httpd/opt/tmpfs
bash: /opt/tmpfs: is a directory
<M> mtu:/ # /var/storage/chroot-smtp/spool 62G 9.2G 49G 16% /var/sec/chroot-httpd/var/spx/spool
bash: /var/storage/chroot-smtp/spool: is a directory
<M> mtu:/ # /var/storage/chroot-smtp/spx 62G 9.2G 49G 16% /var/sec/chroot-httpd/var/spx/public/images/spx
bash: /var/storage/chroot-smtp/spx: is a directory
<M> mtu:/ # /etc/nwd.d/route 5.2G 3.3G 1.7G 66% /var/sec/chroot-ipsec/etc/nwd.d/route
bash: /etc/nwd.d/route: is a directory
<M> mtu:/ # tmpfs 5.9G 40K 5.9G 1% /var/storage/chroot-http/tmp
bash: tmpfs: command not found
<M> mtu:/ # /var/sec/chroot-afc/var/run/navl 5.2G 3.3G 1.7G 66% /var/storage/chroot-http/var/run/navl
bash: /var/sec/chroot-afc/var/run/navl: is a directory
<M> mtu:/ # tmpfs 5.9G 120K 5.9G 1% /var/storage/chroot-smtp/tmp/ram

I have 2 updates ready to install but am waiting as I don't want to crash it but try to update.

I have manually backed up and cleared my firewall log but that didn't seem to free up any space.

Any help would be appreciated.

Dave



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Could you please Go to Logging & Reporting > Log Settings and share the screenshot of configured settings? 

    Thanks,

  • 0 in reply to David Haven

    Do you really need to keep logs for a year?  If not, change that to every three months or something.  If you need to keep them for whatever reason, slap whoever tells you that.  :P  (I am kidding of course).

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • 0 in reply to Amodin

    If we drop them to every three months will that decrease the size of the logs to a safe state?

  • 0 in reply to David Haven

    it depends on the amount of logdata per day.
    If something goes wrong, the logfiles keeps too big.
    as i know, log rotation & cleaning runs only once by night.
    Click to "logging and reporting" and take a look at the log-statistics.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • 0 in reply to dirkkotte

    Also under 'Logging and Reporting', under 'Reporting Settings', you will want to check the 'Executive Report Settings'.  If the retention time is high, that could be contributing.  The 'Reporting Settings' themselves do not affect your archive (section at the top), but the report retention about halfway down will affect archive (daily, weekly, monthly reports to keep).

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • 0 in reply to David Haven

    Hi David and welcome to the UTM Community!

    The culprit behind getting / filled up is often a slew of un-applied Up2Dates.  What version are you on?

    In your original post above, you said the root partition was at 98%, but then we see:

       /dev/sda6 5.2G 3.3G 1.7G 66% /

    Please show us the output now of: df -h

    I wonder if the log partition is filling up because of a problem that's causing one of the log files to grow explosively.  What do you see with the following?

       du -shx /var/log/*.log | sort -rh | head -10

       (A trick learned from user kerobra 4 years ago.)

    Cheers - Bob
    PS As a mod, I can see the IP from which you're posting and it's in my wife's hometown.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Thanks Bob, I ended up rebuilding the log files. But you are right we have 3 unapplied updates we were trying to wait on until the log file issue was resolved.

    PS hello from upstate NY!!!

Reply Children
No Data
Unfiltered HTML