CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.

First, I hope you're all well and staying safe.
Second, I want to give a "heads up" that you should see more activity here shortly, and maybe a few cosmetic changes.
I'll post more details to the "Announcements" forum soon, so be on the lookout. -E


Results 1 to 4 of 4

Thread: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

  1. #1
    Join Date
    Rep Power

    Default deleting Index directories in /var/log/opt/CPSmartLog-R76/data

    when deleting log files on a R76 FW, the files are deleted but this does not decrease disk space. Is it save to delete the (not used) index directories in /var/log/opt/CPSmartLog-R76/data to save space?
    The issue is described here https://supportcenter.checkpoint.com...ionid=sk114114
    (but the solution is not accessible)

  2. #2
    Join Date
    Rep Power

    Default Re: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

    Can you explain a little more what your issue is? The SK covers an upgraded mgmt server. Is that your case?

  3. #3
    Join Date
    DFW, TX
    Rep Power

    Default Re: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

    Generally, if you unlink a file and your used disk space doesn't go down, some process still has the file open. You can try 'cprestart' to restart all of the Check Point services. WARNING! If this is a firewall (and not just a SmartCenter), it will stop passing traffic while services are restarted.

    You can use 'lsof' to LiSt Open Files and search for your log files. The ones you've deleted probably won't show up, but the process probably has others from the same directory open, too. Depending on the specific process, you may be able to just SIGHUP it, or it may need to be restarted by some other method.

  4. #4
    Join Date
    Rep Power

    Default Re: deleting Index directories in /var/log/opt/CPSmartLog-R76/data

    I would recommend deleting log files ($FWDIR/log/) until you still have logs for a time period you feel comfortable with, then deleting all smart log indexes as well as $SMARTLOGDIR/data/FetchedFiles and let Smart Log rebuild its index from scratch. Create a cron job that will delete logs older then X days daily. Configure $SMARTLOGDIR/smartlog_settings.txt to limit disk usage for index files (or better, update to at least R77.30 and configure it from Smart Dashboard).

    See sk73361 (How to delete the index in SmartLog) and sk96546 (How to control SmartLog disk (disc) usage on SmartLog R77.30 and lower).

Similar Threads

  1. Backup Directories
    By cooluswiz in forum CCSA R70 Exam 156-215.70 (No Longer Offered)
    Replies: 0
    Last Post: 2010-11-22, 12:14
  2. Deleting old Gateways
    By mikewych in forum Licensing
    Replies: 1
    Last Post: 2010-07-20, 04:12
  3. safe to remove old R60 directories?
    By decurion in forum Security Management Server (Formerly SmartCenter Server ((Formerly Management Server))
    Replies: 2
    Last Post: 2010-07-09, 20:00
  4. Permission denied changing directories
    By Joe T in forum Check Point IP Appliances and IPSO (Formerly Sold By Nokia)
    Replies: 0
    Last Post: 2007-12-05, 14:21
  5. Deleting old policies
    By Steve in forum SmartDashboard
    Replies: 1
    Last Post: 2006-06-20, 07:11

Tags for this Thread


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts