Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Subscribers 7 subscribers
  • Views 35609 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Data Disk, Log Disk, Root Partition is Filling Up

Rachelle Johnson

Firmware Version: 9.408-0

We have recently been having issues with our Data Disk, Log Disk, and Root Partition filling up very fast. Multiple emails come in every day notifying us about each of these.

Currently:

Data Disk - 91%

Log Disk - 91%

Root Partition - 91%

I have done some research into what could be causing these problems and have been unsuccessful in resolving it. I tried to delete old logs which had no effect. We have Automatic Log File Deletion set to delete logs after 30 days.

The ten biggest folders are:

The results of df -h are:

I have not yet tried /etc/init.d/postgresql92 rebuild because we are hoping to have no downtime on our system (or very minimal downtime).

Is there something else we can do to see where these issues are coming from and how we can correct them?

Thanks!



This thread was automatically locked due to age.
  • 0 in reply to BAlfson

    Draft: Hello,

       I chased this error which lead me here. In my case, this is a UTM virtual appliance, stock install, FW 9.502-4, 32GB. The VM's single hard disk is provisioned for 50 GB sliced up into eight devices. Over many days, received hourly admin emails warning data disk is filling up" 75%. Ran the postgresql rebuild advice, dashboard showed data disk would drop down to 63% and then rise up to 75%, trigger admin email but stay at 75%. The VM ran well throughout but would throw an admin email every hour.

       Called Support, it was speculated that in /var/storage/cores there were left over dump files from firmware up2dates. Mind you, there may have been other reasons. These are memory/system dumps to disk files that remain for support analysis. In my case, Support went through steps to find them (and they were large-many in the 3 GB size) with names like; http*, conf* and awed.*. I watched while Support did a before size list with >df and >du commands. Carefully and assured, the files were >rm-ed and an after list was scrolled. Data disk runs typically at a nominal 19%. Also learned the 75% threshold is not configurable per Sophos Support.

       Before, I would not have (nor should you) performed these commands without Support's help. The >postgresql rebuild command got me by until Support identified the issue. I share this info in order for you to be better suited to discuss it with Sophos Support. They can determine exactly how to approach your specific "data disk filling up" fix. Once the issue was resolved, Support gave me steps for checking these and removing them as I took notes while the agent remoted to my console.

    Thanks, Patrick

  • 0 in reply to PatrickMcVey

    Hey Patrick

    Thank you very much for sharing this information. I meanwhile solved the issue by installing a new firewall manually and turning off the notifications of the old one until the migration is done ;-) as i use a home-use-only-license, i relied on the community answers so far without the ability to contact sophos support officially.

    again, thanks for sharing!