Disk usage ( / ) is 100%

[provels]

It looks like everything is in /var where the logfiles are stored. I run a VM with a 4GB disk and only have 56MB there. Take a look at Status/System Logs/Settings and see if you are logging all traffic that is allowed to pass. That would fill things pretty quick. If so, clear this check box and reset the logs to get the space back.

After that, I would check your rules and see if you have some excessive logging turned on there. Maybe someone created or was testing a rule and forgot to turn logging off. Hope this helps.

[Grimson]

@provels said in Disk usage ( / ) is 100%:

It looks like everything is in /var where the logfiles are stored. I run a VM with a 4GB disk and only have 56MB there. Take a look at Status/System Logs/Settings and see if you are logging all traffic that is allowed to pass. That would fill things pretty quick.

pfSense uses circular logs, so unless he has increased the log file size setting considerably none of the logs from the base system will fill up the disk. This is more likely, and like @teamits suggested, a package going rampant.

[provels]

So

du -Pshx /var/*

 du -Pshx /var/log/*

to track it down.

[FroLien]

Thank you for your reply @teamits
My system is not running Suricata?

[FroLien]

@provels
I clear that check box and reset the logs files. But still 100%.

[FroLien]

@provels said in Disk usage ( / ) is 100%:

du -Pshx /var/log/*

I use above command in Command Prompt. But still 100%.

[provels]

@FroLien Can you post the output results?

[FroLien]

Hi @provels
Thank you for your quick reply. May I show you my output results.

[FroLien]

Dear @teamits
I am not running Suricata on my system.

[provels]

@FroLien Looks like it's your Squid cache (I think so anyway, I don't run Squid). I think you just need a larger disk. Can you expand it? Maybe to 20GB?

[FroLien]

@provels said in Disk usage ( / ) is 100%:

be

Can I delete logs folder from squid?

[FroLien]

@provels
Opps

I deleted logs folder from /var/squid
After I deleted it, i got over half of free space.

I deleted it with this command.
rm -r /var/squid/logs in shell (8)

[provels]

@FroLien It's not the logs, it's the cached info that Squid serves (images, etc, etc) so they don't have to be retrieved again from the Internet. How much disk space do you have allocated for Squid in settings?

EDIT - Well OK then... :) It was the logs... I don't have Squid installed, so I don't know what the file structure is at that level. I still think I'd make your disk about 10-20GB...

[FroLien]

Hi @provels
How can I check disk space of Squid?

[FroLien]

Hi @provels
I think this is it? Please educate me how much space should I assign.

[provels]

@FroLien Those look like the defaults. But look on the Squid General /Logging Settings. You can either A) Disable logging or B) Set a period to rotate the logs (maybe a day? a week?). By default rotation is disabled, so the logs will keep growing until you run out of disk. If you are logging in Squidguard, too, you should also turn on rotation on first settings page.

[Derelict]

Almost always enabling squid logging without enabling rotation.