Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 26 subscribers
  • Views 1719 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Reduce Size /var/newdb/base/16386 (133GB)

Andy C

XG Firewall SFOS 18.0.4 MR-4

Just started receiving reports of the /var utilising over 90% space.


The main culprit is the directory /var/newdb/base/16386 this has nearly 22000 files totalling 133GB dating back over a year to when the virtual appliance was deployed.

/var is currently at 88% but it has hit over 90% : dev/var 181.0G 159.6G 21.4G 88% /var

What are the files in this directory and can they be purged in anyway?

Example:

-rw------- 1 nobody 0 8192 Jun 3 10:37 4131945
-rw------- 1 nobody 0 8192 Jun 3 10:37 4131981
-rw------- 1 nobody 0 8192 Jun 3 10:37 4131955
-rw------- 1 nobody 0 8192 Jun 3 10:38 4131965
-rw------- 1 nobody 0 8192 Jun 3 10:38 4131953
-rw------- 1 nobody 0 8192 Jun 3 10:42 4109037
-rw------- 1 nobody 0 8192 Jun 3 10:42 4109029
-rw------- 1 nobody nobody 8192 Jun 3 10:44 11748_vm
-rw------- 1 nobody nobody 8192 Jun 3 10:44 11771_vm
-rw------- 1 nobody 0 24576 Jun 3 10:51 1751681_fsm
-rw------- 1 nobody nobody 2351104 Jun 3 10:51 1751681
-rw------- 1 nobody nobody 24576 Jun 3 10:51 11744_fsm
-rw------- 1 nobody 0 8192 Jun 3 10:52 3676363
-rw------- 1 nobody 0 8192 Jun 3 10:52 3676355
-rw------- 1 nobody 0 270180352 Jun 3 10:54 3996511
-rw------- 1 nobody 0 420962304 Jun 3 10:54 3990515
-rw------- 1 nobody 0 406683648 Jun 3 10:54 3980518
-rw------- 1 nobody nobody 270336 Jun 3 10:56 11797
-rw------- 1 nobody nobody 270336 Jun 3 10:56 11798
-rw------- 1 nobody nobody 4980736 Jun 3 10:56 1751683
-rw------- 1 nobody nobody 6610944 Jun 3 10:56 1751682
-rw------- 1 nobody nobody 8192 Jun 3 10:56 11775_vm
-rw------- 1 nobody nobody 8192 Jun 3 10:56 11760_vm
-rw------- 1 nobody nobody 8192 Jun 3 10:56 11744_vm
-rw------- 1 nobody 0 95672 Jun 3 10:56 pg_internal.init



This thread was automatically locked due to age.
  • FormerMember
    0 FormerMember

    Hi ,

    Thanks for reaching out to the Community! 

    Could you please check the output of the following command: 

    • df /var/newdb/base/16386

    Thanks,

  • 0 in reply to FormerMember

    Hi Harsh,

    Thank you for your help:

    SFVUNL_SO01_SFOS 18.0.4 MR-4# df /var/newdb/base/16386
    Filesystem 1K-blocks Used Available Use% Mounted on
    /dev/var 189782584 167282108 22484092 88% /var

  • FormerMember
    0 FormerMember in reply to FormerMember

    Hi ,

    Is on-box reporting turned on? Please check with the following command from the console: 

    SFVUNL_SO01_SFOS 18.0.5 MR-5# cish
    console> show on-box-reports
    Local Reporting : on

    If it is turned on, try to flush the reports on your firewall; check out the following KBA for more info:

    Thanks,

  • +1 in reply to FormerMember

    Reporting was on and I had already flushed the reports.

    This has since resolved itself as on Friday as the device stopped working (nothing to do with the space) and stopped processing requests. We've had to roll back to a backup to get partly working again as the device randomly lost the Firewall rules, so I restored, then later lost the licence information, so restored again. Still having issues with SSO ran for a day after another restore and now constantly going to Captive Portal.

    So other factors have made this redundant now.