Thanks for your reply Matthew.

BTW, I got the issue resolved by cleaning the /var partition removing a
decompressed R75.10 installer, several "export" backups and a couple of cap
files generated with fw monitor, that were placed there while doing some
throubleshooting for another issue.

I guess everybody is used to place in /var whatever files require disk
space...

Regards

On Sun, Feb 12, 2012 at 1:10 PM, Matthew Odendaal <matthew@isa....> wrote:

> Hi Sergio
>
> Unfortunately it applies to the 2012 appliances as well.
>
> Kind Regards
>
> Matthew Odendaal
> Technical Manager
>
> Information Security Architects
> matthew@isa....
>
>
> -----Original Message-----
> From: Mailing list for discussion of Firewall-1 [mailto:
> FW-1-MAILINGLIST@AMAD...] On Behalf Of Sergio Alvarez
> Sent: 09 February 2012 05:15 PM
> To: FW-1-MAILINGLIST@AMAD...
> Subject: Re: [FW-1] Root partition full, unable to update IPS
>
> Thanks to you too Matthew.
>
> Now that you explained that about the /var and /var/log partitions, I
> finally understand a lot of things... I was not aware of difference between
> the appliances and the regular SPLAT versions (which is what Imostly work
> with).
>
> Then, I have a question, this change with the /var partition applies only
> to the UTM-1 appliances or does it also to the new 2012 appliances? I
> installed a couple of those already and have several more on the way.
>
> Regards
>
> On Thu, Feb 9, 2012 at 9:08 AM, Matthew Odendaal <matthew@isa....>
> wrote:
>
> > Hi Sergio
> >
> > Remember that on appliances, the /var partition is not a separate
> > partition. Only /var/log is defined as a separate partition. Which
> > means that if there are any Check Point products on the box that
> > normally use /var for their files, those files are actually residing
> > on the root partition on an appliance. A good example is SmartEvent and
> SmartReporter.
> > If you have either of those, make sure that you make symbolic links
> > for the events_db directory to point to somewhere under /var/log. Also
> > make sure that any temp directory you have created under var (for
> > patches etc) are moved to /var/log.
> >
> > I also agree that in all likelihood, you have a number of files under
> > $CPDIR/tmp which can be removed if they begin with "file{something}".
> >
> > I don't know why Check Point decided to move away from using /var as
> > the major partition on appliances. It causes many problems, especially
> > when you enable kernel crash dumps and they write to /var/crash and fill
> up the disk.
> >
> >
> > Matthew Odendaal
> > Technical Manager
> >
> > Information Security Architects
> > matthew@isa....
> >
> >
> >
> >
> >
> > -----Original Message-----
> > From: Mailing list for discussion of Firewall-1 [mailto:
> > FW-1-MAILINGLIST@AMAD...] On Behalf Of Sergio
> > Alvarez
> > Sent: 09 February 2012 04:13 AM
> > To: FW-1-MAILINGLIST@AMAD...
> > Subject: [FW-1] Root partition full, unable to update IPS
> >
> > Hello.
> >
> > This customer or ours has a UTM-1 appliance running R75.10, recently
> > found out IPS updates are failing, error says "unable to put files on
> > server", another error message says URLF updates are also failing, for
> > that it says "insufficient disk space". The "df -h" command showed the
> > root partition is the one with 100% usage.
> > On /var partition you can remove logs or backups, but what can be
> > safely removed from the root partition to make up some space and get
> > the issue resolved?
> >
> > Regards
> >
> > --
> > Sergio Alvarez
> > CISSP | CCSE+
> >
> > =================================================
> > To set vacation, Out-Of-Office, or away messages, send an email to
> > LISTSERV@amad...
> > in the BODY of the email add:
> > set fw-1-mailinglist nomail
> > =================================================
> > To unsubscribe from this mailing list, please see the instructions at
> > http://www.checkpoint.com/services/mailing.html
> > =================================================
> > If you have any questions on how to change your subscription options,
> > email
> > fw-1-owner@ts.c...==========================================
> > =======
> >
> > Scanned by Check Point Total Security Gateway.
> >
> > =================================================
> > To set vacation, Out-Of-Office, or away messages, send an email to
> > LISTSERV@amad...
> > in the BODY of the email add:
> > set fw-1-mailinglist nomail
> > =================================================
> > To unsubscribe from this mailing list, please see the instructions at
> > http://www.checkpoint.com/services/mailing.html
> > =================================================
> > If you have any questions on how to change your subscription options,
> > email fw-1-owner@ts.c...
> > =================================================
> >
>
>
>
> --
> Sergio Alvarez
> CISSP | CCSE+
>
> =================================================
> To set vacation, Out-Of-Office, or away messages, send an email to
> LISTSERV@amad...
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your subscription options,
> email fw-1-owner@ts.c...=================================================
>
> Scanned by Check Point Total Security Gateway.
>
> Scanned by Check Point Total Security Gateway.
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to LISTSERV@amad...
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> fw-1-owner@ts.c...
> =================================================
>



--
Sergio Alvarez
CISSP | CCSE+

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amad...
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.c...
=================================================