Hello,
I'm new to Opnsense and I've been using a new Opnsense installation for ~1.5 months. During that time, the disk usage has been steadily increasing. I have default settings for logging in System > Settings > Logging (Enabled, Maximum Preserved Files 31, no maximum size) which I understand should result in retaining only 31 days of logs. My only significant plugin is AdGuardHome, which I've configured to retain the last 7 days of DNS requests and the last 24 hours of statistics.
My hardware is an HP T620 Plus thin client PC with a 16GB SSD that's currently 75% full and increasing. At this rate, it will fill the disk in less than 2 weeks. I also noticed that there's an 8GB swap partition set up by the Opnsense installer (which seems to be the default since I didn't configure it), resulting in only 8GB available to the system which doesn't help. The "2GB Swap File" option under System > Settings > Miscellaneous is disabled; I'm not sure how this interacts with the 8GB swap partition that was automatically set up during installation. File system is ZFS.
I don't mind buying a larger SSD if that's the solution, but not if it will simply delay the problem. Any advice?
Thanks!
cd /
du -skx * | sort -rn
That gives you the largest directory on top.
cd <largest directory>
du -skx * | sort -rn
Repeat the last steps until you find what is using all that disk space.
Thanks Patrick, this put me on the right track. The offending files seem to be the firewall logs in
/var/log/filter
There are huge (1 Gig +) daily files in that directory. I have logging disabled for all of my firewall rules, but the automatically generated rules all have logging enabled and I see no way to disable it. So I guess the only option is to decrease the logging retention interval in System > Settings > Logging. I thought 31 days is reasonable, but I didn't realize that by default Opnsense has so much firewall logging enabled.
Firewall > Settings > Logging :)
Thank you, again!