*Something* is filling up my hard drive causing Unbound DNS service to die

[Stitch10925]

Hey everyone,

I recently upgraded to the latest version of OpnSense (24.7). I started getting internet dropouts where DNS would not resolve but teh OpnSense UI would still work and it could still pull updates.

I have OpnSense in a Proxmox VM and switched to VirtIO network drivers because throughput was much higher. Initially I thought that was the issue, so I reverted them back to Intel drivers. Yet, the issue remained.

I recently discovered that the hard drive was full (disk usage showed 106% use). I added about 10 GB of storage space to the VM, yet a few days later the disk was full again. I also noticed that, when rebooting the machine, it would hang on the Netflow Backup script step.

I looked at the Netflow settings and cleared all the data from it. I also disabled logging for it. On the same page I could also clear and disable DNS request logging, which I did. And behold, my drive use went down with 40%. Awesome!

But... a few days later, the disk is full again. I checked the Netflow settings again, they are still disabled. Check other log setting to make sure nothing was verbose logging and check if retentions were set to a reasonable level. Clearing the Netflow data did nothing this time.

So something is filling up my disk space causing Unbound DNS to die and not start again, but I can't seem to find what it is. Anyone have any idea how I can troubleshoot this issue or what might be the cause?

[Patrick M. Hausen]

Try this method:

1. log in to a OPNsense via SSH as root
2. `cd / ; du -sk * | sort -rn`
3. pick the largest directory, assume its "foo"
4. `cd foo`
5. `du -sk * | sort -rn`
6. pick the largest directory, iterate 4. - 6.

until you found what files are using all that disk space.

[Stitch10925]

Thank you for the suggestion.

I noticed the problem is with the Firewall's "Plain View" logs. They keep on filling up the hard drive and I haven't found a way to turn them off or to configure its retention time.

[Patrick M. Hausen]

System > Settings > Logging, maybe?