deleting Index directories in /var/log/opt/CPSmartLog-R76/data

[fierens]

when deleting log files on a R76 FW, the files are deleted but this does not decrease disk space. Is it save to delete the (not used) index directories in /var/log/opt/CPSmartLog-R76/data to save space?
The issue is described here https://supportcenter.checkpoint.com...ionid=sk114114
(but the solution is not accessible)

[jflemingeds]

Can you explain a little more what your issue is? The SK covers an upgraded mgmt server. Is that your case?

[Bob_Zimmerman]

Generally, if you unlink a file and your used disk space doesn't go down, some process still has the file open. You can try 'cprestart' to restart all of the Check Point services. WARNING! If this is a firewall (and not just a SmartCenter), it will stop passing traffic while services are restarted.

You can use 'lsof' to LiSt Open Files and search for your log files. The ones you've deleted probably won't show up, but the process probably has others from the same directory open, too. Depending on the specific process, you may be able to just SIGHUP it, or it may need to be restarted by some other method.

[Jejerod]

I would recommend deleting log files ($FWDIR/log/) until you still have logs for a time period you feel comfortable with, then deleting all smart log indexes as well as $SMARTLOGDIR/data/FetchedFiles and let Smart Log rebuild its index from scratch. Create a cron job that will delete logs older then X days daily. Configure $SMARTLOGDIR/smartlog_settings.txt to limit disk usage for index files (or better, update to at least R77.30 and configure it from Smart Dashboard).

See sk73361 (How to delete the index in SmartLog) and sk96546 (How to control SmartLog disk (disc) usage on SmartLog R77.30 and lower).