Problems with SSD filling up
-
Thank you teamits.
Helping peer new2fire I found the large files to be either snort or squid related a few months ago. I manually deleted the logs and a week or so later they were there.
Over time the user rebuilt box from scratch and it happened again.
-
Also getting following error:
PHP errors
PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 2496, Message: Allowed memory size of 536870912 bytes exhausted (tried to allocate 8192 bytes) @ 2018-06-20 15:48:17
-
@teamits I did the
find / -type f -size +50M
and got the following:
/root/ntopng.core 125595648 is the size of that file
-
The PHP error is the PHP process going over 512 MB RAM. That's pretty big for a PHP process. Do you have a lot of pfBlockerNG aliases or something? Check Firewall/pfBlockerNG/Logs? It should be only a relatively few lines per day. (50?)
The .core file is going to be a core dump for a crashed process and delete-able. Even if it's huge, and taking up lots of space by itself, that wouldn't explain "slowly filling up."
-
Under "StatusSystem/Logs/Firewall/Normal View"
there are a lot. the 50 that fill up the page occur within 6 min.
Under "Firewall/pfBlockerNG/Logs" What am I looking for? Nothing shows up in 'log'. There are several drop downs, but not sure what to select.
-
We have our pfB,lockerNG updating once a day. What is the CRON Settings schedule set to on Firewall/pfBlockerNG/General?
-
it is set to every hour. The default setting.
-
So, Under: Firewall/pfBlockerNG/General
I changed the "Log File Size" from default 20,000 to 10,000. It immediately dropped my disk usage to 10%. That must have been it. The default PFSense setting must assume most users will have larger drive. Thank you both and I will keep monitoring and provide update.
I also changed the Cron setting to once a day. But I don't think that this was the issue.
-
Good news new2fire!!
-
So, I have been watching my disk space again and it is creeping up again. It is up to 45% since I posted that I had gotten it down to 10%, 25 days ago. I have not made any changes.
