Data Disk, Log Disk, Root Partition is Filling Up

Hi Rachelle,

The quickest way to resolve this is to rebuild database using the command /etc/init.d/postgresql92 rebuild but, you have to loose the reporting data.

You can also try another way if that helps, go to the directory and remove the files. 

cd /var/storage/pgsql92/data/pg_xlog

rm 000000010000000800000XX

Make sure to keep the last few files on the disk, rest can be deleted.

Hope that helps. 

Thank you for the help. We ended up running the command /etc/init.d/postgresql92 rebuild.

We didn't notice any downtime and this resolved the problem. I am continuing to monitor to see if this will have to be done every so often.

If this is not a Sophos hardware appliance, you're not using a disk that's large enough.  If it is a Sophos device, you might consider reducing 'Web Protection Reporting Detail Level' to "Full Domain" in 'Reporting Settings'.

Cheers - Bob

If this is not a Sophos hardware appliance, you're not using a disk that's large enough.  If it is a Sophos device, you might consider reducing 'Web Protection Reporting Detail Level' to "Full Domain" in 'Reporting Settings'.

Cheers - Bob

Hi Bob!

Thanks for answering the previous questions. i ran into a similar problem with my virtual appliance (ovf template from esx, installed originally in march 2015). i have the logs under control (currently 2% of 5.5 GB) but the data disk keeps filling up.

my appliance runs firmware 9.414-2 and the license id is 759962

it startet around amonth ago: the data disk (4.1 GB) fills up with a rate of about 1% every 4 hours. when it reaches 75% it stops, but sends me a mail every 4 hours.

after running the postgresql92 rebuild command, usage drops to 39%, but then climbs again with the same rate.

is there a possibility to idendify the cause of the data growth or could i somehow just extend the data disk (space is available!).

looking forward to hear from you guys - thanks for the great product ond services!

stefan

Hi, Stefan, and welcome to the UTM Community!

It sounds like you installed the VM with only a 20GB virtual disk - 60GB is the recommended minimum.  It might be best to just get a configuration backup, create a new VM w/60GB and VMXNET3 NICs, and then restore the backup to it.

Cheers - Bob

Hi Bob!

Thanks for your answer. i got the last virtual appliance by downloading it from the vmware VA Marketplace (trough a vCenter Server) so it came preconfigured with those disk size values. nevertheless, i've downloaded the latest installer, created a linux vm with 60 GB disk from scratch and installed the firewall using the default setup routine.

through the dashboard, i just saw that even the new installation without a restore only allocated a 26 GB log partition and a 20 GB data partition.

do i manually have to extend this data disk?

by the way: the previous installation reached the 75% disk usage treshold again within 30 days :-/ i'm afraid i'll end up having two firewalls sending me notifications soon :-)

If this is a home-use situation, Stefan, that should be adequate.

Cheers - Bob

Hi Bob

Please do not get me wrong - i am using this homefirewall since 2015 and was really happy with the functionality. for business use, we have multiple hardware appliances with correct licensing and no issues with them.

i never had issues with the data partition uage until about 3 months ago where, after an update, the partition startet filling up constantly until 70% usage is reached and the notification alert is triggered. i attach an image to you for better understanding. the only thing that helps me for a month period of time is rebuilding the postgre-sql database.

seems like a bug to me? i would be happy to help with logs and stuff to improve the software..

What do you see when you run the following at the command line?

du -hsx /var/storage/* | sort -rh | head -10

Cheers - Bob

Draft: Hello,

   I chased this error which lead me here. In my case, this is a UTM virtual appliance, stock install, FW 9.502-4, 32GB. The VM's single hard disk is provisioned for 50 GB sliced up into eight devices. Over many days, received hourly admin emails warning data disk is filling up" 75%. Ran the postgresql rebuild advice, dashboard showed data disk would drop down to 63% and then rise up to 75%, trigger admin email but stay at 75%. The VM ran well throughout but would throw an admin email every hour.

   Called Support, it was speculated that in /var/storage/cores there were left over dump files from firmware up2dates. Mind you, there may have been other reasons. These are memory/system dumps to disk files that remain for support analysis. In my case, Support went through steps to find them (and they were large-many in the 3 GB size) with names like; http*, conf* and awed.*. I watched while Support did a before size list with >df and >du commands. Carefully and assured, the files were >rm-ed and an after list was scrolled. Data disk runs typically at a nominal 19%. Also learned the 75% threshold is not configurable per Sophos Support.

   Before, I would not have (nor should you) performed these commands without Support's help. The >postgresql rebuild command got me by until Support identified the issue. I share this info in order for you to be better suited to discuss it with Sophos Support. They can determine exactly how to approach your specific "data disk filling up" fix. Once the issue was resolved, Support gave me steps for checking these and removing them as I took notes while the agent remoted to my console.

Thanks, Patrick

Hey Patrick

Thank you very much for sharing this information. I meanwhile solved the issue by installing a new firewall manually and turning off the notifications of the old one until the migration is done ;-) as i use a home-use-only-license, i relied on the community answers so far without the ability to contact sophos support officially.

again, thanks for sharing!