Disk usage ( / ) is 100%

[FroLien]

Dear All
May I ask you how to solve and how to clean anything from root directory.

We use pfSense as a VM on ESXi 6.0. We assign 5GB of amount for root. When I check in pfSense WebGUI, Disk usage ( / ) is 100% full.

Our pfSense version is 2.3.4 and FreeBSD 10.3-RELEASE-p19.

Please may i know how can i solve this issue.

[Grimson]

@frolien said in Disk usage ( / ) is 100%:

Our pfSense version is 2.3.4 and FreeBSD 10.3-RELEASE-p19.

Act like a responsible Admin and do a fresh install with a currently supported version, then you might get support.

[SteveITS]

Check for log files? Are you running Suricata?

https://forum.netgate.com/topic/137652/suricata-suricata-log-not-rotated
https://forum.netgate.com/topic/140951/suricata-log-files-are-filling-the-disk
https://forum.netgate.com/topic/130980/suricata-not-limiting-log-sizes-by-default

[KOM]

Connect to the console. Run item 8 (Shell). Run this command and see where all the files are:

du -Pshx /*

[Rico]

1. Take a full Backup in the WebGUI
2. Reinstall 2.4.4-p1 with some more space
3. Online Update to 2.4.4-p2
4. Restore your Backup

-Rico

[FroLien]

Thank you for your reply @Rico
If i reinstall, Can I use my backup of WebGUI completely without any changed? Because I am afraid that If I restore backup of WebGUI, i want to get back my all settings all rules without any error.

[FroLien]

Than you for your reply @KOM
I run your command in pfSense command prompt, output was ..

8.0K /COPYRIGHT
1.1M /bin
58M /boot
0B /boot.config
3.1M /cf
0B /conf
12K /conf.default
3.0K /dev
7.3M /etc
20K /home
9.3M /lib
168K /libexec
4.0K /media
4.0K /mnt
4.0K /proc
7.6M /rescue
44K /root
4.7M /sbin
0B /sys
476K /tmp
601M /usr
4.6G /var

[provels]

It looks like everything is in /var where the logfiles are stored. I run a VM with a 4GB disk and only have 56MB there. Take a look at Status/System Logs/Settings and see if you are logging all traffic that is allowed to pass. That would fill things pretty quick. If so, clear this check box and reset the logs to get the space back.

After that, I would check your rules and see if you have some excessive logging turned on there. Maybe someone created or was testing a rule and forgot to turn logging off. Hope this helps.

[Grimson]

@provels said in Disk usage ( / ) is 100%:

It looks like everything is in /var where the logfiles are stored. I run a VM with a 4GB disk and only have 56MB there. Take a look at Status/System Logs/Settings and see if you are logging all traffic that is allowed to pass. That would fill things pretty quick.

pfSense uses circular logs, so unless he has increased the log file size setting considerably none of the logs from the base system will fill up the disk. This is more likely, and like @teamits suggested, a package going rampant.

[provels]

So

du -Pshx /var/*

 du -Pshx /var/log/*

to track it down.

[FroLien]

Thank you for your reply @teamits
My system is not running Suricata?

[FroLien]

@provels
I clear that check box and reset the logs files. But still 100%.

[FroLien]

@provels said in Disk usage ( / ) is 100%:

du -Pshx /var/log/*

I use above command in Command Prompt. But still 100%.

[provels]

@FroLien Can you post the output results?

[FroLien]

Hi @provels
Thank you for your quick reply. May I show you my output results.

[FroLien]

Dear @teamits
I am not running Suricata on my system.

[provels]

@FroLien Looks like it's your Squid cache (I think so anyway, I don't run Squid). I think you just need a larger disk. Can you expand it? Maybe to 20GB?

[FroLien]

@provels said in Disk usage ( / ) is 100%:

be

Can I delete logs folder from squid?

[FroLien]

@provels
Opps

I deleted logs folder from /var/squid
After I deleted it, i got over half of free space.

I deleted it with this command.
rm -r /var/squid/logs in shell (8)

[provels]

@FroLien It's not the logs, it's the cached info that Squid serves (images, etc, etc) so they don't have to be retrieved again from the Internet. How much disk space do you have allocated for Squid in settings?

EDIT - Well OK then... :) It was the logs... I don't have Squid installed, so I don't know what the file structure is at that level. I still think I'd make your disk about 10-20GB...

[FroLien]

Hi @provels
How can I check disk space of Squid?

[FroLien]

Hi @provels
I think this is it? Please educate me how much space should I assign.

[provels]

@FroLien Those look like the defaults. But look on the Squid General /Logging Settings. You can either A) Disable logging or B) Set a period to rotate the logs (maybe a day? a week?). By default rotation is disabled, so the logs will keep growing until you run out of disk. If you are logging in Squidguard, too, you should also turn on rotation on first settings page.

[Derelict]

Almost always enabling squid logging without enabling rotation.