Data Disk Filling Up Very Fast

Hi mate,

When you click "Logging and Reporting" whats the Current Fill Up Rate? Under "Logging and Reporting > View Log Files" what is the largest log file? I'd expect it to be firewall or web protection.

What modules are you using primarily?

Copy and pasted this. Its highly unaccurate, as its filling up in 2-3 days.

Logs and the OS are stored on separate partitions. You indicated that it was the data disk that was filling up so I wouldn't expect to see anything abnormal with your logs.

Hi ,

Can you please run as a super user from ssh/terminal

1) df -h

2)ls -l  /var/storage/cores

3)rpm -qa --last | head -n 10

btw:

should be fine

Sorry not use utm9/xg for more then 6-8 months so can tell you more

Thanks

Hi ,

Can you please run as a super user from ssh/terminal

1) df -h

2)ls -l  /var/storage/cores

3)rpm -qa --last | head -n 10

btw:

should be fine

Sorry not use utm9/xg for more then 6-8 months so can tell you more

Thanks

ran the commands, here are the results.

loginuser@firewall:/home/login > su -
Password:
firewall:/root # df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda6 5.2G 2.3G 2.6G 48% /
udev 5.9G 120K 5.9G 1% /dev
tmpfs 5.9G 0 5.9G 0% /dev/shm
/dev/sda1 331M 16M 295M 5% /boot
/dev/sda5 62G 20G 39G 34% /var/storage
/dev/sda7 81G 275M 76G 1% /var/log
/dev/sda8 3.5G 178M 3.2G 6% /tmp
tmpfs 5.9G 0 5.9G 0% /var/sec/chroot-httpd/dev/shm
tmpfs 5.9G 0 5.9G 0% /var/storage/chroot-reverseproxy/dev/shm
tmpfs 5.9G 48K 5.9G 1% /var/storage/chroot-smtp/tmp/ram
tmpfs 5.9G 24K 5.9G 1% /var/storage/chroot-http/tmp
firewall:/root # ls -l /var/storage/cores
total 0
firewall:/root # rpm -qa -last | head -n 10
u2d-savi-9-8911 Thu 24 Mar 2016 12:34:45 PM EDT
u2d-avira3-9-13925 Thu 24 Mar 2016 12:34:30 PM EDT
u2d-geoip-7-107 Fri 18 Mar 2016 12:35:38 PM EDT
u2d-cadata-9-72 Fri 18 Mar 2016 12:35:26 PM EDT
u2d-ohelp9-9-122 Fri 18 Mar 2016 12:35:14 PM EDT
u2d-man9-9-91 Fri 18 Mar 2016 12:35:03 PM EDT
u2d-appctrl43-9-13 Thu 17 Mar 2016 04:00:13 PM EDT
ep-release-9.355-1 Thu 17 Mar 2016 04:00:13 PM EDT
glibc-locale-2.11.3-17.95.2.1656.ga688674.rb4 Thu 17 Mar 2016 04:00:12 PM EDT
glibc-2.11.3-17.95.2.1656.ga688674.rb4 Thu 17 Mar 2016 04:00:09 PM EDT

Hi ,

quick thoughts is

1)log archive is woking ?

2)why not ask support staff to rebuild database

3)which mode of proxy you are using ?

4)when log data is almost full which log consume most of the space (you can check this from gui in logging section ) (sorry cant tell you exact where and i dont have utm /xg installled now )

5)try to change default anti-virus /sophos to avira or/and avira to sophos

/dev/sda5 62G 8.4G 50G 15% /var/storage seems to be the culprit, it doesn't appear filled now as I just cleared the cache.

Using Transparent mode.

Our license/subscription doesn't include antivirus.

Anti-Virus comes with Web Protection, Webserver Protection and Email Protection, so, unless you have purposely disabled it, it is active on your system.

Check /var/storage/cores now and when the partition is fuller again - that should tell us what the problem is.  I suspect that Shrikant's insight about rebuilding the PostgreSQL data bases is correct, but let's see what you find.

Cheers - Bob

PS If this turns out to be the issue, please PM me the case# you had for this.

I was able to get to /var/storage/cores and see postgres.4262. Excuse my lack of knowledge but how do I open it and view its contents?

The key issue was just seeing which process was causing core dumps.  If switching to the other antivirus engine resolved your issue, I wouldn't bother with the core dump problem.

Cheers - Bob