My Hard Drive ran out of space, so I think everything stopped logging. Here is DF-m output:
Filesystem 1M-blocks Used Avail Capacity Mounted on
/dev/gpt/rootfs 110079 100558 715 99% /
devfs 0 0 0 100% /dev
/dev/gpt/efifs 255 1 254 1% /boot/efi
tmpfs 3995 3995 0 100% /var/log
tmpfs 3995 2 3993 0% /tmp
devfs 0 0 0 100% /var/dhcpd/dev
devfs 0 0 0 100% /var/unbound/dev
/usr/local/lib/python3.9 110079 100558 715 99% /var/unbound/usr/local/lib/python3.9
Is there any way to tell everything to log for one or two months and delte everything older?
Thanks
In my opinion it would be better to reduce the logging that is happening. Unless of course you need to have that much logging. If so and then the answer to your question would require you to script it and add your script(s) to cron manually.
Thanks for your response.
I guess I have to rebuild yet another router with a humungous Hard drive. I dont have skills required to implement your suggestion.
It would be nice if there was a "Disk Management" Plugin for us "GUI" folks so I could just add a USB thumb drive and designate it for logging
Hello,
I have the same problem, that opnsense occupies almost 60G of the disk. I emptied the log, but still:
Quoteroot@OPNsense-Main:~ # df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/gpt/rootfs 108G 56G 43G 57% /
devfs 1.0K 1.0K 0B 100% /dev
fdescfs 1.0K 1.0K 0B 100% /dev/fd
procfs 4.0K 4.0K 0B 100% /proc
devfs 1.0K 1.0K 0B 100% /var/dhcpd/dev
devfs 1.0K 1.0K 0B 100% /var/unbound/dev
devfs 1.0K 1.0K 0B 100% /var/unbound/dev
/usr/local/lib/python3.9 108G 56G 43G 57% /var/unbound/usr/local/lib/python3.9
What is this python3.9 thing about? When I go to the folder /var/unbound/usr/local/lib/python3.9 and do a du -hs, it only reports a size of 375M??
Quoteroot@OPNsense-Main:/usr/local/lib/python3.9 # du -hs
375M .
Any idea? Reboot didn't do anything.
@meschmesch: that's just an additional mountpoint within the root filesystem. The `df` output is irrelevant.
Note that the numbers are identical to /.
Try for example
cd /
du -skx * | sort -rn
Then cd into the largest directory and work downwards repeating the commands above.
@pmhausen, you are a genious :) It was elasticsearch (zenarmor). Erase Reporting Data did the job. Thank you!
Just Installed a new 1tb SSD, only 2 days in and:
SYSTEM: LOG FILES: GENERAL>
2023-06-03T18:19:19 Notice syslog-ng Suspending write operation because of an I/O error; fd='31', time_reopen='60'
2023-06-03T18:19:19 Error syslog-ng I/O error occurred while writing; fd='31', error='No space left on device (28)'
2023-06-03T18:19:19 Notice syslog-ng Error suspend timeout has elapsed, attempting to write again; fd='31'
2023-06-03T18:19:14 Notice syslog-ng Suspending write operation because of an I/O error; fd='24', time_reopen='60'
2023-06-03T18:19:14 Error syslog-ng I/O error occurred while writing; fd='24', error='No space left on device (28)'
Is this writing to RAM only. I wish there was a plugin or better menu options as per where on the drive to store log files.
In system > Logging - see that you have all tickboxes unticked and the "preserve log (days)" empty. That will leave you with deafult logging which should be manageable even on small disks.
Then on system > settings > Miscellaneous , there is a section "Disk / Memory Settings (reboot to apply changes)"
You seem to have enabled the use of ram for /tmp and /var/log.
Disable those and your logs will go the filesystem where the first settings will rotate them.
Thank You So Much cookiemonster!