What gets stored on /cf/conf/acb?

[senseivita]

There's been a sudden spike on disk usage, I found there's 3.5GB worth of what seem hashed data or something.

[2.6.0-RELEASE][root@routelogic.domain1.tld]/: du -sch *
4.5K	COPYRIGHT
875K	bin
105M	boot
3.5G	cf
512B	conf
9.5K	conf.default
3.5K	dev
4.5K	entropy
3.9M	etc
 28K	home
7.3M	lib
137K	libexec
512B	media
512B	mnt
512B	net
1.0K	pfSense
512B	proc
7.3M	rescue
101K	root
3.1M	sbin
2.0M	tmp
792M	usr
105M	var
4.5G	total
[2.6.0-RELEASE][root@routelogic.domain1.tld]/: cd cf
[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf: du -sch *
3.5G	conf
3.5G	total
[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf: cd conf
[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf/conf: du -sch *
3.5G	acb
 76K	acme
 51M	backup
173K	config.xml
4.5K	copyright
512B	dyndns_wancloudflare'dmarc.domain1.tld'0.cache
512B	dyndns_wanhe-net-tunnelbroker'123456'1.cache
512B	pkg_log_.txt
4.5K	pkg_log_pfSense-pkg-Avahi.txt
4.5K	pkg_log_pfSense-pkg-Lightsquid.txt
4.5K	pkg_log_pfSense-pkg-Notes.txt
4.5K	pkg_log_pfSense-pkg-Open-VM-Tools.txt
4.5K	pkg_log_pfSense-pkg-Status_Traffic_Totals.txt
4.5K	pkg_log_pfSense-pkg-acme.txt
4.5K	pkg_log_pfSense-pkg-arpwatch.txt
4.5K	pkg_log_pfSense-pkg-bandwidthd.txt
4.5K	pkg_log_pfSense-pkg-darkstat.txt
4.5K	pkg_log_pfSense-pkg-haproxy-devel.txt
4.5K	pkg_log_pfSense-pkg-ntopng.txt
4.5K	pkg_log_pfSense-pkg-pfBlockerNG-devel.txt
4.5K	pkg_log_pfSense-pkg-squid.txt
4.5K	pkg_log_pfSense-pkg-squidGuard.txt
4.5K	pkg_log_pfSense-pkg-stunnel.txt
4.5K	pkg_log_pfSense-pkg-suricata.txt
 29K	rules.debug.old
512B	syslog_default_uncompressed
512B	upgrade_log.txt
149K	widget_image.picture-0
3.5G	total
[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf/conf:

[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf/conf/acb: ls -laphFS
total 3633661
-rw-r--r--  1 root  wheel   940K Oct 28 08:15 e30770fb7dd50c170fb985036e0770b300b1c9c5813ce7f85a510dd03cfbb55c.data
-rw-r--r--  1 root  wheel   940K Oct 28 08:25 e01d7db0dd421b4e88d7b18117ac30e0ec9000aa02abbea0790153358a8f0db6.data
-rw-r--r--  1 root  wheel   940K Oct 28 08:24 883a848a790e683c985173855c5f8a465c0e11cc619bd6bbbf0e21f2d34089e0.data

…


-rw-r--r--  1 root  wheel   414B Jul 21 19:28 89e59346f245969e723c03c7400c58fbbd9eed35604b4500d0bf5a9029aa0c4f.form
-rw-r--r--  1 root  wheel   414B Sep 14 17:23 a2546ad85afbe0d5af8a460843740ec1a1801b9c6b5f08aa679db83a275dfa03.form
-rw-r--r--  1 root  wheel   414B Oct  4 23:49 e763237e1fc6653520ba817d38ef17a6594ae2beef8f310a969ed5ca3e68a994.form
drwxr-xr-x  5 root  wheel    30B Nov  1 19:00 ../
[2.6.0-RELEASE][root@routelogic.domain1.tld]/cf/conf/acb:

Some of these appear to be some sort of cron job, they're all on the dot:

-rw-r--r--  1 root  wheel   821K Sep 11 23:00 81b89da2cfb0293f47ac392945877f7e288e6c3575a193bcf8084267cc7592f5.data
-rw-r--r--  1 root  wheel   821K Sep 12 19:00 97710bdec5fb882b2d6be01c866c1af050d36f36444eaa6acd6e230f83e8bbec.data
-rw-r--r--  1 root  wheel   821K Sep 12 05:00 9852929be34e8eb0b7a61f789f2090d39b3bbd66226e5a34906191a2d6bd3eef.data
-rw-r--r--  1 root  wheel   821K Sep 11 16:00 a125c33054b5b5616f6aed99f0e547733efca925e2a4f8f81a1f1171ed94c4bd.data
-rw-r--r--  1 root  wheel   821K Sep 12 20:00 a9d7cf5076d2415d2d302edb9d888193bf923ab1ae8293cfaded3125ba37c59d.data
-rw-r--r--  1 root  wheel   821K Sep 11 09:00 af1ac05830d83465e7700502c18c92c467a30789b3cb44ad873e999087ae92b5.data
-rw-r--r--  1 root  wheel   821K Sep 12 13:00 b314d8cc1313ccfa9c241c60ce43efc189073cde5341c0043148fac570a2c3ad.data
-rw-r--r--  1 root  wheel   821K Sep 12 21:00 bb5b1e8f3fe6d51c42c6131396382e51832a01ea1f2ec4fc178dcba87468a91b.data
-rw-r--r--  1 root  wheel   821K Sep 11 17:00 c95ecccef6de3198898f322db5a65a3b3a9cd442275f213ac0c65d78e94d318a.data
-rw-r--r--  1 root  wheel   821K Sep 11 14:00 ca35661a9278120992b6067f1bb0e01eb84d0298616889340298e4484ac8476f.data

I can just delete these right? If it's an anomaly, probably the data is unaccounted for—I think.

Any advice? :)

[rcoleman-netgate]

@skilledinept You can delete them, yes, they're just the staging files for what gets uploaded to the AutoConfigBackup servers.

[senseivita]

@rcoleman-netgate Thanks !

Now that you mention it I do remember the seeing the long strings there. And I'm just realizing those are numbers, not hashes. It "only" took me about 3-4 years. :)

Thanks again!