Hi Sergio
Remember that on appliances, the /var partition is not a separate partition.
Only /var/log is defined as a separate partition. Which means that if there are
any Check Point products on the box that normally use /var for their files,
those files are actually residing on the root partition on an appliance. A good
example is SmartEvent and SmartReporter. If you have either of those, make sure
that you make symbolic links for the events_db directory to point to somewhere
under /var/log. Also make sure that any temp directory you have created under
var (for patches etc) are moved to /var/log.
I also agree that in all likelihood, you have a number of files under
$CPDIR/tmp which can be removed if they begin with "file{something}".
I don't know why Check Point decided to move away from using /var as the major
partition on appliances. It causes many problems, especially when you enable
kernel crash dumps and they write to /var/crash and fill up the disk.
Matthew Odendaal
Technical Manager
Information Security Architects
[email protected]
-----Original Message-----
From: Mailing list for discussion of Firewall-1
[mailto:[email protected]] On Behalf Of Sergio Alvarez
Sent: 09 February 2012 04:13 AM
To: [email protected]
Subject: [FW-1] Root partition full, unable to update IPS
Hello.
This customer or ours has a UTM-1 appliance running R75.10, recently found out
IPS updates are failing, error says "unable to put files on server", another
error message says URLF updates are also failing, for that it says
"insufficient disk space". The "df -h" command showed the root partition is the
one with 100% usage.
On /var partition you can remove logs or backups, but what can be safely
removed from the root partition to make up some space and get the issue
resolved?
Regards
--
Sergio Alvarez
CISSP | CCSE+
=================================================
To set vacation, Out-Of-Office, or away messages, send an email to
[email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your subscription options, email
[email protected] =================================================
Scanned by Check Point Total Security Gateway.
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================
