Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 7 subscribers
  • Views 73866 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Disk Filling Up Very Fast

AChu87

My SG320 seems to have an issue with its data disk being filled up to 95% every two or three days. It will keep sending me email notifications to check it. I've gone through an RMA already as Sophos Tech couldn't figure out the problem thinking it was hardware related.  Only solution I have is to clear web cache. 

Have you guys had this issue?



This thread was automatically locked due to age.
  • 0 in reply to AChu87

    Hi ,

    quick thoughts is

    1)log archive is woking ?

    2)why not ask support staff to rebuild database

    3)which mode of proxy you are using ?

    4)when log data is almost full which log consume most of the space (you can check this from gui in logging section ) (sorry cant tell you exact where and i dont have utm /xg installled now )

    5)try to change default anti-virus /sophos to avira or/and avira to sophos

  • 0 in reply to utmng_kid

    /dev/sda5 62G 8.4G 50G 15% /var/storage seems to be the culprit, it doesn't appear filled now as I just cleared the cache.

    Using Transparent mode.

    Our license/subscription doesn't include antivirus.

  • 0 in reply to AChu87

    Anti-Virus comes with Web Protection, Webserver Protection and Email Protection, so, unless you have purposely disabled it, it is active on your system.

    Check /var/storage/cores now and when the partition is fuller again - that should tell us what the problem is.  I suspect that Shrikant's insight about rebuilding the PostgreSQL data bases is correct, but let's see what you find.

    Cheers - Bob

    PS If this turns out to be the issue, please PM me the case# you had for this.

  • 0 in reply to BAlfson

    I was able to get to /var/storage/cores and see postgres.4262. Excuse my lack of knowledge but how do I open it and view its contents?

  • 0

    I located the section to chage from Sophos Anti Virus to Avira, the disk seems to be staying on 12%, and not filling up. I'll keep an eye on it for a few days. Do you know why this is?

  • 0 in reply to AChu87

    The key issue was just seeing which process was causing core dumps.  If switching to the other antivirus engine resolved your issue, I wouldn't bother with the core dump problem.

    Cheers - Bob

  • 0

    hello, we had a similiar problem, the problem was caused by an adobe download which was stuck in the web protection and scanned all the time and disk was filling up. we made an exception for http://ardownload.adobe.com exceptions="av,auth,content,url,cache,fileextension,ssl,certificate check

    the temp directory filled up all the time

    we deleted it with

    cd /var/chroot-http/var/tmp
    rm tmp_*

    check of the directory

    asg:/var/storage # ll -th /var/chroot-http/var/tmp/

  • 0 in reply to SebastianMair

    The problem seemed to have went a way for a few weeks after applying this this adobe exception. But it is now reoccurring again.  How can I find out exactly what is filling up the cache?

  • 0

    This is where the fill up is happening. This is only a portion of whats in there.

    firewall:/var/storage/chroot-http/var/tmp # ll -th
    total 16G
    -rw------- 1 httpproxy httpproxy 382K May 5 13:00 tmp_egXBDa
    -rw------- 1 httpproxy httpproxy 8.6M May 5 13:00 tmp_hh95Jn
    -rw------- 1 httpproxy httpproxy 12M May 5 13:00 tmp_yb1m6H
    -rw------- 1 httpproxy httpproxy 12M May 5 13:00 tmp_Jkcb5g
    -rw------- 1 httpproxy httpproxy 12M May 5 13:00 tmp_0ictWv
    -rw------- 1 httpproxy httpproxy 12M May 5 13:00 tmp_a4JPfq
    -rw------- 1 httpproxy httpproxy 12M May 5 12:59 tmp_5ZrOPd
    -rw------- 1 httpproxy httpproxy 12M May 5 12:59 tmp_0K4CBu
    -rw------- 1 httpproxy httpproxy 12M May 5 12:59 tmp_AogmMQ
    -rw------- 1 httpproxy httpproxy 12M May 5 12:59 tmp_8FZB4f
    -rw------- 1 httpproxy httpproxy 12M May 5 12:59 tmp_zH8gWb
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_1lsRCE
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_D9dSkV
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_eqMddD
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_MjwJAS
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_47UAbm
    -rw------- 1 httpproxy httpproxy 12M May 5 12:58 tmp_e5zeMw
    -rw------- 1 httpproxy httpproxy 12M May 5 12:57 tmp_sdnjk2
    -rw------- 1 httpproxy httpproxy 12M May 5 12:57 tmp_Eeln6K
    -rw------- 1 httpproxy httpproxy 12M May 5 12:57 tmp_53U0RL
    -rw------- 1 httpproxy httpproxy 12M May 5 12:57 tmp_8jsMd0
    -rw------- 1 httpproxy httpproxy 12M May 5 12:57 tmp_Q6a8bX
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_QPB9ym
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_0llUws
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_aXxwIc
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_nvl4nE
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_hV6QDg
    -rw------- 1 httpproxy httpproxy 12M May 5 12:56 tmp_7QNN78
    -rw------- 1 httpproxy httpproxy 12M May 5 12:55 tmp_v7gmAC
    -rw------- 1 httpproxy httpproxy 12M May 5 12:55 tmp_AfdOM7
    -rw------- 1 httpproxy httpproxy 12M May 5 12:55 tmp_sZGyIn
    -rw------- 1 httpproxy httpproxy 12M May 5 12:55 tmp_WwWRSC
    -rw------- 1 httpproxy httpproxy 12M May 5 12:55 tmp_hnPD21
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_RSSWfK
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_DsIHgh
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_e9Ty0t
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_EMfnOg
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_h9ylny
    -rw------- 1 httpproxy httpproxy 12M May 5 12:54 tmp_X4d3zM
    -rw------- 1 httpproxy httpproxy 12M May 5 12:53 tmp_C5ItdH
    -rw------- 1 httpproxy httpproxy 12M May 5 12:53 tmp_LDYPWh
    -rw------- 1 httpproxy httpproxy 12M May 5 12:53 tmp_KesoBy
    -rw------- 1 httpproxy httpproxy 12M May 5 12:53 tmp_ym9fbv
    -rw------- 1 httpproxy httpproxy 12M May 5 12:53 tmp_GVZHx7
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_2nI4lR
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_tzqBx2
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_mNSWEG
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_Xhr3E0
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_kT2gL0
    -rw------- 1 httpproxy httpproxy 12M May 5 12:52 tmp_WAXqHG
    -rw------- 1 httpproxy httpproxy 12M May 5 12:51 tmp_eVbno2
    -rw------- 1 httpproxy httpproxy 12M May 5 12:51 tmp_8N9zc4
    -rw------- 1 httpproxy httpproxy 12M May 5 12:51 tmp_brTKZL
    -rw------- 1 httpproxy httpproxy 12M May 5 12:51 tmp_So4MJ9
    -rw------- 1 httpproxy httpproxy 12M May 5 12:51 tmp_pFO3df
    -rw------- 1 httpproxy httpproxy 12M May 5 12:50 tmp_3dlrx2
    -rw------- 1 httpproxy httpproxy 12M May 5 12:50 tmp_51DmSv
    -rw------- 1 httpproxy httpproxy 12M May 5 12:50 tmp_8UnI6E
    -rw------- 1 httpproxy httpproxy 12M May 5 12:50 tmp_5PgNWt
    -rw------- 1 httpproxy httpproxy 12M May 5 12:50 tmp_Vm6NGY
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_z5p1P9
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_rVUcq0
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_SPEUzJ
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_UsZKoW
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_ZxASRN
    -rw------- 1 httpproxy httpproxy 12M May 5 12:49 tmp_G71fBn
    -rw------- 1 httpproxy httpproxy 12M May 5 12:48 tmp_s50nWB
    -rw------- 1 httpproxy httpproxy 12M May 5 12:48 tmp_pbiW7w
    -rw------- 1 httpproxy httpproxy 12M May 5 12:48 tmp_5TvBfb
    -rw------- 1 httpproxy httpproxy 12M May 5 12:48 tmp_OpSavv
    -rw------- 1 httpproxy httpproxy 12M May 5 12:48 tmp_Jam3nv
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_jUbBUa
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_ICQzQw
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_6zTHBa
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_mdVV0R
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_tZ1crK
    -rw------- 1 httpproxy httpproxy 12M May 5 12:47 tmp_iTvn6N
    -rw------- 1 httpproxy httpproxy 12M May 5 12:46 tmp_nZ0Dtx
    -rw------- 1 httpproxy httpproxy 12M May 5 12:46 tmp_zOXYbW
    -rw------- 1 httpproxy httpproxy 12M May 5 12:46 tmp_FI78u1
    -rw------- 1 httpproxy httpproxy 12M May 5 12:46 tmp_WDkIOO
    -rw------- 1 httpproxy httpproxy 12M May 5 12:46 tmp_D66z4j
    -rw------- 1 httpproxy httpproxy 12M May 5 12:45 tmp_6sCCWu
    -rw------- 1 httpproxy httpproxy 12M May 5 12:45 tmp_0kN9Al
    -rw------- 1 httpproxy httpproxy 12M May 5 12:45 tmp_26m6wS
    -rw------- 1 httpproxy httpproxy 12M May 5 12:45 tmp_SeHLg5
    -rw------- 1 httpproxy httpproxy 12M May 5 12:45 tmp_mLud6X
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_lt25L9
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_Wt29to
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_MvfqTi
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_aOUgqg
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_2AkYow
    -rw------- 1 httpproxy httpproxy 12M May 5 12:44 tmp_Mdxyyq
    -rw------- 1 httpproxy httpproxy 12M May 5 12:43 tmp_1gaJT2
    -rw------- 1 httpproxy httpproxy 12M May 5 12:43 tmp_Otr5hk
    -rw------- 1 httpproxy httpproxy 12M May 5 12:43 tmp_JQJS5h
    -rw------- 1 httpproxy httpproxy 12M May 5 12:43 tmp_IrpJ6V
    -rw------- 1 httpproxy httpproxy 12M May 5 12:43 tmp_KggK7f

  • 0 in reply to AChu87

    Someone else here reported a similar problem recently.  The issue was a server that didn't "like" the Anti-Virus scan.  You can clear the Web Filtering cache on the 'Misc' tab of 'Filtering Options' and create an AV Exception for the server.  I bet you can see in the Web Filtering log between 12:43 and 13:00 what access was causing the problem - maybe at 13:00 when the request finally failed.  Let us know.

    Cheers - Bob