Root partition is filling up - please check. Current usage: 85%

I bet you will find lots of old crash dumps with:

     ll /var/storage/cores

You can rm any file that's not needed to investigate a current problem.

Cheers - Bob

Bob,

Already deleted them. There were just two of them.

Dale, did you try

     du -shx /var/*

The next-most-likely culprit is /var/storage/pgsql92/data/pg_xlog.

Cheers - Bob

Dale, did you try

     du -shx /var/*

The next-most-likely culprit is /var/storage/pgsql92/data/pg_xlog.

Cheers - Bob

The plot thickens....

That 289M certainly isn't enough to make a big difference.  Must be something else unusual in /var/storage.  Try

      du -shx /var/storage/* |sort -rh |head -10

Cheers - Bob

1.7G ~ rough math.

Interesting that du -shx /var/storage/* does not reflect the 4.x GB that df-h says is in /var/storage/chroot-http/var/run/navl 

(See first screenshot)

df -h shows the usage of the partition that /var/storage/chroot-http/var/run/navl is in, the / partition.

/var/storage/chroot-http/var looks suspiciously large.

I'm out of guesses, Dale - what does Sophos Support say about this?

Cheers - Bob

As far as I know, I am unsupported. This is in my home lab. Not good that you are out of ideas.....

What if you du /var/storage/chroot-http/var, Dale, and look for what's so big there?

Since it's your home lab, you might consider taking some config backups off and re-imaging with the latest ISO.

Cheers - Bob

Per your suggestion.

If I rebuild, would a weekly config backup get me back to 100%? Never done a backup restore.

Can I just LiveCD (gparted) and expand the partition?

You can generate config backups at will.  I would get a new one off the UTM as well as a couple other recent ones just to be safe.  Put the one, most-recent backup on a USB memory stick, insert it and power the UTM up.

The only things you lose with a re-image and restore is the logs and reporting.  If those are important to you, you can copy them off and back on with WinSCP.

Cheers - Bob