Thanks for your reply Matthew. BTW, I got the issue resolved by cleaning the /var partition removing a decompressed R75.10 installer, several "export" backups and a couple of cap files generated with fw monitor, that were placed there while doing some throubleshooting for another issue.
I guess everybody is used to place in /var whatever files require disk space... Regards On Sun, Feb 12, 2012 at 1:10 PM, Matthew Odendaal <[email protected]> wrote: > Hi Sergio > > Unfortunately it applies to the 2012 appliances as well. > > Kind Regards > > Matthew Odendaal > Technical Manager > > Information Security Architects > [email protected] > > > -----Original Message----- > From: Mailing list for discussion of Firewall-1 [mailto: > [email protected]] On Behalf Of Sergio Alvarez > Sent: 09 February 2012 05:15 PM > To: [email protected] > Subject: Re: [FW-1] Root partition full, unable to update IPS > > Thanks to you too Matthew. > > Now that you explained that about the /var and /var/log partitions, I > finally understand a lot of things... I was not aware of difference between > the appliances and the regular SPLAT versions (which is what Imostly work > with). > > Then, I have a question, this change with the /var partition applies only > to the UTM-1 appliances or does it also to the new 2012 appliances? I > installed a couple of those already and have several more on the way. > > Regards > > On Thu, Feb 9, 2012 at 9:08 AM, Matthew Odendaal <[email protected]> > wrote: > > > Hi Sergio > > > > Remember that on appliances, the /var partition is not a separate > > partition. Only /var/log is defined as a separate partition. Which > > means that if there are any Check Point products on the box that > > normally use /var for their files, those files are actually residing > > on the root partition on an appliance. A good example is SmartEvent and > SmartReporter. > > If you have either of those, make sure that you make symbolic links > > for the events_db directory to point to somewhere under /var/log. Also > > make sure that any temp directory you have created under var (for > > patches etc) are moved to /var/log. > > > > I also agree that in all likelihood, you have a number of files under > > $CPDIR/tmp which can be removed if they begin with "file{something}". > > > > I don't know why Check Point decided to move away from using /var as > > the major partition on appliances. It causes many problems, especially > > when you enable kernel crash dumps and they write to /var/crash and fill > up the disk. > > > > > > Matthew Odendaal > > Technical Manager > > > > Information Security Architects > > [email protected] > > > > > > > > > > > > -----Original Message----- > > From: Mailing list for discussion of Firewall-1 [mailto: > > [email protected]] On Behalf Of Sergio > > Alvarez > > Sent: 09 February 2012 04:13 AM > > To: [email protected] > > Subject: [FW-1] Root partition full, unable to update IPS > > > > Hello. > > > > This customer or ours has a UTM-1 appliance running R75.10, recently > > found out IPS updates are failing, error says "unable to put files on > > server", another error message says URLF updates are also failing, for > > that it says "insufficient disk space". The "df -h" command showed the > > root partition is the one with 100% usage. > > On /var partition you can remove logs or backups, but what can be > > safely removed from the root partition to make up some space and get > > the issue resolved? > > > > Regards > > > > -- > > Sergio Alvarez > > CISSP | CCSE+ > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, send an email to > > [email protected] > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your subscription options, > > email > > [email protected]========================================== > > ======= > > > > Scanned by Check Point Total Security Gateway. > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, send an email to > > [email protected] > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your subscription options, > > email [email protected] > > ================================================= > > > > > > -- > Sergio Alvarez > CISSP | CCSE+ > > ================================================= > To set vacation, Out-Of-Office, or away messages, send an email to > [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your subscription options, > email > [email protected]================================================= > > Scanned by Check Point Total Security Gateway. > > Scanned by Check Point Total Security Gateway. > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= > -- Sergio Alvarez CISSP | CCSE+ ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
