Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Subscribers 8 subscribers
  • Views 39239 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Disk, Log Disk, Root Partition is Filling Up

Rachelle Johnson

Firmware Version: 9.408-0

We have recently been having issues with our Data Disk, Log Disk, and Root Partition filling up very fast. Multiple emails come in every day notifying us about each of these.

Currently:

Data Disk - 91%

Log Disk - 91%

Root Partition - 91%

I have done some research into what could be causing these problems and have been unsuccessful in resolving it. I tried to delete old logs which had no effect. We have Automatic Log File Deletion set to delete logs after 30 days.

The ten biggest folders are:

The results of df -h are:

I have not yet tried /etc/init.d/postgresql92 rebuild because we are hoping to have no downtime on our system (or very minimal downtime).

Is there something else we can do to see where these issues are coming from and how we can correct them?

Thanks!



This thread was automatically locked due to age.
Parents
  • +1

    Hi Rachelle,

    The quickest way to resolve this is to rebuild database using the command /etc/init.d/postgresql92 rebuild but, you have to loose the reporting data.

    You can also try another way if that helps, go to the directory and remove the files. 

    cd /var/storage/pgsql92/data/pg_xlog


    rm 000000010000000800000XX

    Make sure to keep the last few files on the disk, rest can be deleted.

    Hope that helps. 

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Thank you for the help. We ended up running the command /etc/init.d/postgresql92 rebuild.

    We didn't notice any downtime and this resolved the problem. I am continuing to monitor to see if this will have to be done every so often.

  • 0 in reply to Rachelle Johnson

    If this is not a Sophos hardware appliance, you're not using a disk that's large enough.  If it is a Sophos device, you might consider reducing 'Web Protection Reporting Detail Level' to "Full Domain" in 'Reporting Settings'.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob!

    Thanks for answering the previous questions. i ran into a similar problem with my virtual appliance (ovf template from esx, installed originally in march 2015). i have the logs under control (currently 2% of 5.5 GB) but the data disk keeps filling up.

    my appliance runs firmware 9.414-2 and the license id is 759962

    it startet around amonth ago: the data disk (4.1 GB) fills up with a rate of about 1% every 4 hours. when it reaches 75% it stops, but sends me a mail every 4 hours.

    after running the postgresql92 rebuild command, usage drops to 39%, but then climbs again with the same rate.

    is there a possibility to idendify the cause of the data growth or could i somehow just extend the data disk (space is available!).

    looking forward to hear from you guys - thanks for the great product ond services!

    stefan

  • 0 in reply to stefan gabriel

    Hi, Stefan, and welcome to the UTM Community!

    It sounds like you installed the VM with only a 20GB virtual disk - 60GB is the recommended minimum.  It might be best to just get a configuration backup, create a new VM w/60GB and VMXNET3 NICs, and then restore the backup to it.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob!

    Thanks for your answer. i got the last virtual appliance by downloading it from the vmware VA Marketplace (trough a vCenter Server) so it came preconfigured with those disk size values. nevertheless, i've downloaded the latest installer, created a linux vm with 60 GB disk from scratch and installed the firewall using the default setup routine.

    through the dashboard, i just saw that even the new installation without a restore only allocated a 26 GB log partition and a 20 GB data partition.

    do i manually have to extend this data disk?

    by the way: the previous installation reached the 75% disk usage treshold again within 30 days :-/ i'm afraid i'll end up having two firewalls sending me notifications soon :-)

Reply
  • 0 in reply to BAlfson

    Hi Bob!

    Thanks for your answer. i got the last virtual appliance by downloading it from the vmware VA Marketplace (trough a vCenter Server) so it came preconfigured with those disk size values. nevertheless, i've downloaded the latest installer, created a linux vm with 60 GB disk from scratch and installed the firewall using the default setup routine.

    through the dashboard, i just saw that even the new installation without a restore only allocated a 26 GB log partition and a 20 GB data partition.

    do i manually have to extend this data disk?

    by the way: the previous installation reached the 75% disk usage treshold again within 30 days :-/ i'm afraid i'll end up having two firewalls sending me notifications soon :-)

Children
  • 0 in reply to stefan gabriel

    If this is a home-use situation, Stefan, that should be adequate.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bob

    Please do not get me wrong - i am using this homefirewall since 2015 and was really happy with the functionality. for business use, we have multiple hardware appliances with correct licensing and no issues with them.

    i never had issues with the data partition uage until about 3 months ago where, after an update, the partition startet filling up constantly until 70% usage is reached and the notification alert is triggered. i attach an image to you for better understanding. the only thing that helps me for a month period of time is rebuilding the postgre-sql database.

    seems like a bug to me? i would be happy to help with logs and stuff to improve the software..

  • 0 in reply to stefan gabriel

    What do you see when you run the following at the command line?

    du -hsx /var/storage/* | sort -rh | head -10

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Draft: Hello,

       I chased this error which lead me here. In my case, this is a UTM virtual appliance, stock install, FW 9.502-4, 32GB. The VM's single hard disk is provisioned for 50 GB sliced up into eight devices. Over many days, received hourly admin emails warning data disk is filling up" 75%. Ran the postgresql rebuild advice, dashboard showed data disk would drop down to 63% and then rise up to 75%, trigger admin email but stay at 75%. The VM ran well throughout but would throw an admin email every hour.

       Called Support, it was speculated that in /var/storage/cores there were left over dump files from firmware up2dates. Mind you, there may have been other reasons. These are memory/system dumps to disk files that remain for support analysis. In my case, Support went through steps to find them (and they were large-many in the 3 GB size) with names like; http*, conf* and awed.*. I watched while Support did a before size list with >df and >du commands. Carefully and assured, the files were >rm-ed and an after list was scrolled. Data disk runs typically at a nominal 19%. Also learned the 75% threshold is not configurable per Sophos Support.

       Before, I would not have (nor should you) performed these commands without Support's help. The >postgresql rebuild command got me by until Support identified the issue. I share this info in order for you to be better suited to discuss it with Sophos Support. They can determine exactly how to approach your specific "data disk filling up" fix. Once the issue was resolved, Support gave me steps for checking these and removing them as I took notes while the agent remoted to my console.

    Thanks, Patrick

  • 0 in reply to PatrickMcVey

    Hey Patrick

    Thank you very much for sharing this information. I meanwhile solved the issue by installing a new firewall manually and turning off the notifications of the old one until the migration is done ;-) as i use a home-use-only-license, i relied on the community answers so far without the ability to contact sophos support officially.

    again, thanks for sharing!

Unfiltered HTML