how to clean "/dev/mapper/local-var"

[Guest]

[hakangunaydin]

Hi,

I am using the community version for 1.5 years.

Now the firewall says there is problem with disk space :

Filesystem            Size  Used Avail Use% Mounted on
 /dev/sda1              73G  514M   69G   1% /
 /dev/mapper/local-var
                       344G  326G     0 100% /var
 /dev/mapper/local-config
                        99M  4.9M   89M   6% /var/efw
 /dev/mapper/local-log
                        20G  145M   19G   1% /var/log


How could I clean "/dev/mapper/local-var"

Thanks

[kashifmax]

Login to the firewall via ssh and go to /var/ /var/log/ and remove unnecessary logs. For examples compressed logs are in /var/archives/ /var/log/archives/, this is for EFW 2.5.1 and not sure that this path also exist in prior versions of EFW...

[mrkroket]

The problem is not in /var/log, the problem is in /var, they are different partitions.
/var/log has 19G free.

You should go to console (via SSH/putty or local) or WinSCP, and review the disk usage on /var

[kashifmax]

Oops! I didn't saw that also Thanks for pointing it out. Modifying comments also

[blackisle]

I've had the same issue - found that the /var/spool is the one chewing disk space, nothing to do with the logging.
On our install it's the squid directory that's lumped up 22GB in the space of 3 weeks - filling the /dev/mapper/local-var and leaving no space for further squid logs/cache items.
Reason for this: I'd set the Squid Cache size to 50000MB (27000MB more than was actually available)
Fix: either use the GUI to clear the proxy cache and set the proxy size to a sensible value (5GB now, leaves 15GB for logging)
or from ssh:
/etc/init.d/squid stop
rm -rf /var/spool/squid/*
nano /etc/squid/squid.conf     *** edit line "cache_dir aufs /var/spool/squid <cache size in MB> 16 256"
squid -z         (recreates the cache structure)
/etc/init.d/squid start