Netgate 5100 disk utilization at 81%

[mercadof]

My SG 5100 is showing 81% disk utilization and has steadily kept growing over the last few months. Following some suggestions in this forum I made the below queries. My question is what can I do to flush some of the high utilization folders in the outputs below?

I am at Release 23.09.1 and I do not believe my appliance is using zfs. It states 81% of 6.7G (ufs)

du -d 1 -h /
4.0K /.snap
4.5K /dev
2.2G /usr
4.7M /sbin
4.7M /cf
5.7M /tmp
4.0K /mnt
4.0K /media
2.1G /var
164K /libexec
6.0M /etc
4.0K /net
12K /conf.default
194M /root
1.4M /bin
4.0K /proc
22M /lib
27M /rescue
410M /boot
4.0K /home
5.0G /

du -d 1 -h /var
8.0K /var/crash
4.0K /var/msgs
4.0K /var/account
12K /var/at
12K /var/audit
2.1G /var/db
14M /var/unbound
4.0K /var/mail
4.0K /var/yp
115K /var/run
4.0K /var/games
14M /var/log
4.0K /var/authpf
4.0K /var/empty
4.0K /var/backups
8.0K /var/cron
56K /var/tmp
4.0K /var/rwho
4.0K /var/heimdal
20K /var/cache
32K /var/spool
4.0K /var/preserve
60K /var/etc
3.7M /var/dhcpd
8.0K /var/lib
2.1G /var

[stephenw10]

Check inside /var/db. It could be the pkg cache. You can clear that with: pkg clean -ay

Consider fitting an m.2 SATA drive: https://docs.netgate.com/pfsense/en/latest/solutions/sg-5100/m-2-sata-installation.html

Steve

[mercadof]

@stephenw10 said in Netgate 5100 disk utilization at 81%:

pkg clean -ay

Thanks for the reply. I used the command you suggested and all I got back was "Nothing to do" response. I will look into the SATA, but if there is something that is causing files to be inflated, I would like to cure that problem first.

Thanks again.

[stephenw10]

Still look inside /var/db then. Something there is using a lot of space.

[mercadof]

@stephenw10
That is what I am trying to find out. Can you let me know exactly how to look for this? I am not familiar with the CLI commands.

[SteveITS]

@mercadof
du -d 2 -h /var/db

“-d” is depth.

[mercadof]

@SteveITS Ok, thank you for that. This is what I got back:
14M /var/db/pkg
12K /var/db/entropy
4.0K /var/db/ntp
4.0K /var/db/ports
4.0K /var/db/portsnap
4.0K /var/db/zfsd/cases
8.0K /var/db/zfsd
4.0K /var/db/freebsd-update
4.0K /var/db/ipf
4.0K /var/db/hyperv
12M /var/db/rrd
8.0K /var/db/pingstatus
8.0K /var/db/pingmsstatus
24K /var/db/snort/sidmods
12K /var/db/snort/iprep
40K /var/db/snort
328K /var/db/pfblockerng/original
4.0K /var/db/pfblockerng/native
252K /var/db/pfblockerng/deny
4.0K /var/db/pfblockerng/match
4.0K /var/db/pfblockerng/permit
14M /var/db/pfblockerng/dnsbl
3.8M /var/db/pfblockerng/dnsblorig
14M /var/db/pfblockerng/dnsblalias
4.0K /var/db/pfblockerng/ET
33M /var/db/pfblockerng
4.0K /var/db/aliastables
264K /var/db/fontconfig
8.0K /var/db/ntopng/rrd
2.0M /var/db/ntopng/-1
701M /var/db/ntopng/0
182M /var/db/ntopng/1
12M /var/db/ntopng/2
17M /var/db/ntopng/3
1.1G /var/db/ntopng/4
2.2M /var/db/ntopng/5
148K /var/db/ntopng/category_lists
7.4M /var/db/ntopng/6
672K /var/db/ntopng/plugins0
2.0G /var/db/ntopng
4.0K /var/db/redis
4.0K /var/db/mtree
4.0K /var/db/kea
4.0K /var/db/dhcpcd
2.1G /var/db

[stephenw10]

Ah ntopng data is using a lot. Are you actively using ntopng?

[mercadof]

@stephenw10 said in Netgate 5100 disk utilization at 81%:

ntopng

I show it as active. Not sure if I need this running. Is it safe to turn it off?

[stephenw10]

Yes it's an add-on package you can disable it at any time. If you never check it it's not really helping anyway.

You can also just clear it's data too.

[mercadof]

@stephenw10 I turned it off and unchecked the Keep Data/Settings. Does that clear the data that is already stored? If not how do I clear it?

[stephenw10]

Nope that just means it won't keep it if you uninstall it. There is a 'Delete Data' button at the bottom of the page in Diag > Ntopng Settings.

[mercadof]

@stephenw10 That worked! Utilization back down to 47%. Thank you so much for your help.

[stephenw10]

No worries. I would still consider adding an SSD. Especially if you're going to continue running ntopng as it writes a lot of data and wares the eMMC. The 5100 is particularly unhelpful if the eMMC ever fails!

[mercadof]

@stephenw10 I ordered one yesterday. Should be in tomorrow. Looks like a weekend project for me. Thanks again.