Log Directory Filled

[longhill]

Hello.
I use NGX R62 FW-1.

The directory /var has filled:

[Expert@Managment]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda3 1.9G 155M 1.6G 9% /
none 1.9G 155M 1.6G 9% /dev/pts
/dev/sda1 1.9G 38M 1.8G 3% /boot
/dev/sda6 2.8G 342M 2.3G 13% /opt
none 1.5G 0 1.5G 0% /dev/shm
/dev/sda5 2.8G 335M 2.3G 13% /sysimg
/dev/sda7 120G 120G 0 100% /var

I have the error:

[Expert@Managment]# cat CPbackup_err.txt
Cannot complete the backup process: not enough space in /var/CPbackup/backups .
Backup operation failed.

What files I can delete?

[abusharif]

you can check for any old backups in /var/CPbackup
Remove or move them somewhere else.

compress/move old logs from $FWDIR/log

etc..

[longhill]

There's a function of DashBoard or Secure Platform command that enabling erase the old log?

Thanks a lot

[longhill]

I have the directory $ FWDIR / log full.
The Tracker, sometimes behaves in a strange logging only if specifically the source address of the connection.
This can be caused by the fact that the $ FWDIR / log is full?

Thanks

[melipla]

Its more than the log file being full, your /var partition is full. All CP products use directories in /var/x/x/x/, so the fact that this is full will affect everything--things like logging, pushing policy, creating objects, etc.

I would copy the largest files you have off the system and then delete them from the system. Start with the older log files, which aren't actively being used:

2.0G 2008-02-11_000001.log
2.0G 2008-02-18_000001.log
2.0G 2008-03-03_000001.log
2.0G 2008-03-03_000001.log
2.0G 2008-03-10_000001.log
2.0G 2008-03-10_000001.log
2.1G 2007-03-26_130115_1.log
2.1G 2007-04-30_120324_1.log
2.1G 2007-07-04_110635_2.log
2.1G 2007-07-15_100936_1.log
2.1G 2007-07-21_141158_2.log
2.1G 2007-07-29_053656_1.log
2.1G 2007-08-04_131728_1.log
2.1G 2007-08-10_190204_2.log
2.1G 2007-08-17_025501_3.log
2.1G 2007-08-23_153001_4.log
2.1G 2007-08-30_015621_5.log
2.1G 2007-09-05_140700_6.log
2.1G 2007-09-12_173622_1.log
2.1G 2007-09-19_155118_2.log
2.1G 2007-09-26_043610_3.log
2.1G 2007-10-02_145324_4.log
2.1G 2007-10-09_071329_5.log
2.1G 2007-10-16_095710_6.log
2.1G 2007-10-20_170521_7.log
2.1G 2007-10-25_060803_8.log
2.1G 2007-10-29_184542_1.log
2.1G 2007-11-04_011620_2.log
2.1G 2007-11-09_075007_3.log
2.1G 2007-11-14_124601_4.log
2.1G 2007-11-19_121414_5.log
2.1G 2007-11-24_071847_6.log
2.1G 2007-11-29_032813_7.log
2.1G 2007-12-03_201440_8.log
2.1G 2007-12-08_090630_9.log
2.1G 2007-12-13_233210_10.log
2.1G 2007-12-19_211119_11.log
2.1G 2007-12-26_004155_12.log
2.1G 2008-01-01_090624_13.log
2.1G 2008-01-12_185803_14.log
2.1G 2008-01-19_151241_15.log
2.1G 2008-01-27_071640_16.log
2.1G 2008-02-03_162323_17.log
2.1G 2008-02-24_225824_18.log
2.1G 2008-03-16_234753_19.log
2.1G 2008-03-16_234753_19.log
2.1G 2008-03-23_233240_20.log


You can eventually copy them back if you need to access the data, but be aware you'll also need the other files that start with the same name but end with ptr. For now the goal is move off the larger files so that you can free up disk space...

[longhill]

Cancellation of the old log should not start automatically? (see attachment)

[melipla]

Originally Posted by longhill

Cancellation of the old log should not start automatically? (see attachment)

Its hard to say why its not working. Maybe there's a bug? Maybe it doesn't know that those specific log files are deletable as it appears they were rotated at random intervals? It looks like its set up to rotate at midnight and every 1000 MB which none of these log files reflect. There's a disconnect between what Smartdashboard says and what the management server is doing, a good reboot might fix that (assuming you have free disk space now).

[longhill]

I have a doubt.
I installed the parameters of log (CheckPoint Gateway --> Log and Master --> Local Log Files, see attachment) only on management ,smartcenter server, and not on module Check Point.
I think it is correct because the logs are only on management.
What do you think?
I must also installed on module CheckPoint?

[melipla]

Originally Posted by longhill

I have a doubt.
I installed the parameters of log (CheckPoint Gateway --> Log and Master --> Local Log Files, see attachment) only on management ,smartcenter server, and not on module Check Point.
I think it is correct because the logs are only on management.
What do you think?

Yes, that is correct. The management server's log files are managed from this screen. The management server should be rotating the logs every 1000 MB and at midnight. Try rebooting your management server and see if the logs are rotated at the proper size and time. Free up disk space before you reboot!

Originally Posted by longhill

I must also installed on module CheckPoint?

You do not have to. The Firewal / VPN-1 module on the gateway should have the management server listed as the log server. This means it will forward the logs to the management server. If the management server goes down, the gateway will log locally until the management server re-establishes connection. So setting up the local log management for the gateway is a good idea, however not necessary for your current problem.

[longhill]

Thanks a lot!
Try to do as suggested.
I know I will!

[srahman]

Hello, I am need of your help.

This query doesn't really relate to the above title, but I am looking to move the logs on a Windows NGX server to a differrent disk on the same server. Can anyone please tell me how to point the logging to another diskspace (i.e D:\ drive) instead of it's default on C:\...

Thank you.

kind regards,
Shaz