Thanks to you too Matthew. Now that you explained that about the /var and /var/log partitions, I finally understand a lot of things... I was not aware of difference between the appliances and the regular SPLAT versions (which is what Imostly work with).
Then, I have a question, this change with the /var partition applies only to the UTM-1 appliances or does it also to the new 2012 appliances? I installed a couple of those already and have several more on the way. Regards On Thu, Feb 9, 2012 at 9:08 AM, Matthew Odendaal <[email protected]> wrote: > Hi Sergio > > Remember that on appliances, the /var partition is not a separate > partition. Only /var/log is defined as a separate partition. Which means > that if there are any Check Point products on the box that normally use > /var for their files, those files are actually residing on the root > partition on an appliance. A good example is SmartEvent and SmartReporter. > If you have either of those, make sure that you make symbolic links for the > events_db directory to point to somewhere under /var/log. Also make sure > that any temp directory you have created under var (for patches etc) are > moved to /var/log. > > I also agree that in all likelihood, you have a number of files under > $CPDIR/tmp which can be removed if they begin with "file{something}". > > I don't know why Check Point decided to move away from using /var as the > major partition on appliances. It causes many problems, especially when you > enable kernel crash dumps and they write to /var/crash and fill up the disk. > > > Matthew Odendaal > Technical Manager > > Information Security Architects > [email protected] > > > > > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 [mailto: > [email protected]] On Behalf Of Sergio Alvarez > Sent: 09 February 2012 04:13 AM > To: [email protected] > Subject: [FW-1] Root partition full, unable to update IPS > > Hello. > > This customer or ours has a UTM-1 appliance running R75.10, recently found > out IPS updates are failing, error says "unable to put files on server", > another error message says URLF updates are also failing, for that it says > "insufficient disk space". The "df -h" command showed the root partition is > the one with 100% usage. > On /var partition you can remove logs or backups, but what can be safely > removed from the root partition to make up some space and get the issue > resolved? > > Regards > > -- > Sergio Alvarez > CISSP | CCSE+ > > ================================================= > To set vacation, Out-Of-Office, or away messages, send an email to > [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your subscription options, > email > [email protected]================================================= > > Scanned by Check Point Total Security Gateway. > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= > -- Sergio Alvarez CISSP | CCSE+ ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
