Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Free up space, disk storage >80%

    Scheduled Pinned Locked Moved General pfSense Questions
    48 Posts 5 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RobbieTTR
      RobbieTT @Gertjan
      last edited by RobbieTT

      @Gertjan said in Free Disk space >80%:

      Status_traffic_totals

      For me running:

       find /var/db/ -type d -ls | sort -n -r
      

      Showed that my ntopng and vnstat (aka Status_traffic_totals) databases were out of control. I have them nicely tamed now:

      find /var/db/ -type d -ls | sort -n -r
       21693        1 drwxr-x---    2 nut                              nut                                     3 May 23 19:31 /var/db/nut
         817        1 drwxr-xr-x    2 nobody                           nobody                                  2 Oct 11 12:28 /var/db/ntopng/rrd/graphics
         816        1 drwxr-xr-x    3 nobody                           nobody                                  3 Oct 11 12:28 /var/db/ntopng/rrd
         815        1 drwxr-xr-x    3 nobody                           nobody                                  3 Oct 11 12:28 /var/db/ntopng
         388        1 drwxr-xr-x    2 redis                            redis                                   2 Feb 17  2023 /var/db/redis
         276       17 drwxr-xr-x    2 root                             wheel                                   5 Mar 15  2023 /var/db/pfblockerng/dnsblalias
         275        1 drwxr-xr-x    2 root                             wheel                                   4 Oct 11 00:15 /var/db/pfblockerng/dnsblorig
         273        1 drwxr-xr-x    2 root                             wheel                                   2 Mar 12  2023 /var/db/pfblockerng/permit
         272        1 drwxr-xr-x    2 root                             wheel                                   2 Mar 12  2023 /var/db/pfblockerng/match
         271       17 drwxr-xr-x    2 root                             wheel                                  13 Oct 11 12:15 /var/db/pfblockerng/deny
         270        1 drwxr-xr-x    2 root                             wheel                                   2 Mar 12  2023 /var/db/pfblockerng/native
         269       17 drwxr-xr-x    2 root                             wheel                                  13 Oct 11 12:15 /var/db/pfblockerng/original
         268       17 drwxr-xr-x   11 root                             wheel                                  15 Oct 11 12:15 /var/db/pfblockerng
         256        1 drwxr-x---    2 _dhcp                            _dhcp                                   2 Aug 21 08:00 /var/db/dhcpcd
         251        1 drwxr-xr-x    2 root                             wheel                                   3 Oct 11 12:25 /var/db/vnstat
         177        1 drwxr-xr-x    2 root                             wheel                                   2 Mar 12  2023 /var/db/pfblockerng/ET
         151        1 drwxr-xr-x    2 root                             wheel                                   4 Oct 10 00:15 /var/db/pfblockerng/dnsbl
         138        1 drwxr-xr-x    2 root                             wheel                                   2 Oct 10 08:24 /var/db/zfsd/cases
         137        1 drwxr-xr-x    2 root                             wheel                                   2 Oct 10 08:24 /var/db/portsnap
         136        1 drwxr-xr-x    2 root                             wheel                                   2 Oct 10 08:24 /var/db/mtree
         135        1 drwx------    2 root                             wheel                                   2 Oct 10 08:24 /var/db/freebsd-update
         134        1 drwxr-xr-x    2 ntpd                             ntpd                                    2 Oct 10 08:24 /var/db/ntp
         133        1 drwxr-xr-x    2 root                             wheel                                   2 Oct 10 08:24 /var/db/ports
         132        1 drwx------    2 root                             wheel                                   2 Oct 10 08:24 /var/db/hyperv
         131        1 drwxr-xr-x    3 root                             wheel                                   3 Oct 10 08:24 /var/db/zfsd
         130        1 drwx------    2 root                             wheel                                   2 Oct 10 08:24 /var/db/ipf
         129       17 drwx------    2 operator                         operator                               10 Oct 10 08:24 /var/db/entropy
         128        1 drwxr-xr-x    2 root                             wheel                                   3 Oct  3 18:59 /var/db/kea
          34       17 drwxr-xr-x   22 root                             wheel                                  41 Oct 11 12:28 /var/db/
          34       17 drwxr-xr-x    2 root                             wheel                                  10 Oct 10 12:04 /var/db/pkg
          28       49 drwxr-xr-x    2 root                             wheel                                   5 May 24 11:59 /var/db/fontconfig
          19        1 drwxr-xr-x    2 root                             wheel                                   4 Jul  9 10:43 /var/db/aliastables
           3       17 drwxr-xr-x    2 nobody                           wheel                                  23 Sep  3 13:32 /var/db/rrd
      

      ☕️

      R 1 Reply Last reply Reply Quote 1
      • R
        RobinH @RobbieTT
        last edited by

        @RobbieTT This is my output in a txt-file because its to big...
        What can I do with it, can I erase much of it?

        output.txt

        1 Reply Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @RobinH
          last edited by

          @RobinH said in Free Disk space >80%:

          The packages I run is Acme, Haproxy, Openvpn-client-export, PfBlocker (disabled, not in use), system_patches, Telegraf and Status_traffic_totals

          @RobinH said in Free Disk space >80%:

          output in a txt-file

          /var/db/ntopng ...

          Did you have ntopng installed, and uninstalled it?

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          R 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Your earlier output shows the total size of /var as 697MB. That's quite big but there is still ~11GB that seem to be unaccounted for.

            R 1 Reply Last reply Reply Quote 0
            • R
              RobinH @SteveITS
              last edited by

              @SteveITS ntopng is not installed, maybe it has been before.

              1 Reply Last reply Reply Quote 0
              • R
                RobinH @stephenw10
                last edited by

                @stephenw10 We have many OpenVPN tunnels, could that be it?

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  No VPNs don't really use any storage.

                  If ntop has been uninstalled then you can remove all those db entries for it in /var.

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    RobinH @stephenw10
                    last edited by

                    @stephenw10 Great, thats something :)
                    Is there a good way to remove the whole ntopng directory from /var/db/ ?

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      You can do a recursive delete but it's...risky! Safer to remove the files inside that directory first.

                      R 2 Replies Last reply Reply Quote 0
                      • R
                        RobinH @stephenw10
                        last edited by

                        @stephenw10 Okay, better not risk more than I have to. But everything inside /var/db/ntopng can be removed.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Yes.

                          RobbieTTR 1 Reply Last reply Reply Quote 0
                          • RobbieTTR
                            RobbieTT @stephenw10
                            last edited by

                            @stephenw10

                            I think ntopng has a GUI button to remove all the database entries, leaving you the uninstall and any remaining rm and rmdir after that.

                            I'm surprised how much space pfblockerNG took; mine is a mere fraction of that.

                            Still lots unaccounted for. The biggest user of space on mine is having version snapshots for different dev loads. The rest is trivial:

                             2023-10-11 at 15.17.36.png

                            Good hunting.

                            ☕️

                            R GertjanG 2 Replies Last reply Reply Quote 0
                            • R
                              RobinH @RobbieTT
                              last edited by

                              @RobbieTT Yeah, I will uninstall the PfBlocker... not using it at all.

                              And will clear the ntopng files...

                              1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @RobbieTT
                                last edited by

                                @RobbieTT said in Free Disk space >80%:

                                I'm surprised how much space pfblockerNG took

                                I presume this happens out there in the wild :
                                People install pfBlockerng, and start to try out all these : Firewall > pfBlockerNG > Feeds because "why not ?".
                                Soon, they'll discover that there is something as a resource limit, and not only disk space, but also that Xeon 8 core processor that goes hot read. An ARM won't make it at all ....

                                All these 'feed' files initially downloaded, and their parsed and assembled counter parts will stay in the sub folders of this folder path /var/db/pfblockerng for until the end of days .... (or pfSense re install) or manual cleaning, as I don't think the /var/db/pfblockerng/. is emptied upon package removal. [ I have to try that one ... ]
                                Still, pfBlockerng is a small example. Processes (programs) that auto generate content are a real admin's nightmare - you have to watch them as you would do with babies. Even on big-iron-servers with loads of disk space (multiple T's) I do graph constantly free inodes and free disk blocks (disk space). Here is the same thing for my pfSense.

                                File rotating for log files is the most straightforward example : as soon as my apache2 servers (or mail server) get swamped by requests, log files start to grow rapidly - like very fast. By simply launching multiple requests the server will steadily fill up its disk space, and then the classic game starts : what comes first : log rotation or server crash.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                1 Reply Last reply Reply Quote 0
                                • R
                                  RobinH @stephenw10
                                  last edited by

                                  @stephenw10

                                  Tried this today, but it seems like there is no files there?

                                  (RobinH@192.168.3.1) Password for RobinH@fw-01.zafe.se:
                                  [2.6.0-RELEASE][RobinH@fw-01.zafe.se]/home/RobinH: cd /var/db/ntopng/rrd
                                  [2.6.0-RELEASE][RobinH@fw-01.zafe.se]/var/db/ntopng/rrd: ls
                                  graphics
                                  [2.6.0-RELEASE][RobinH@fw-01.zafe.se]/var/db/ntopng/rrd:

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Did you manage to free any significant amount of space?

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      RobinH @stephenw10
                                      last edited by

                                      @stephenw10 No, I cant find the entries when i look in Var/db/ntopng

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        What does du -h -d1 / show now?

                                        RobbieTTR R 2 Replies Last reply Reply Quote 0
                                        • RobbieTTR
                                          RobbieTT @stephenw10
                                          last edited by

                                          Is it only me that is triggered by the topic title?

                                          No, just me and symbols then. 🤷

                                          ☕️

                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            RobinH @RobbieTT
                                            last edited by

                                            @RobbieTT Yeah... maybe it should be more like Free up space, disk storage >80%

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.